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Preface 


This document is an update to the specifications contained in the Affected Documents table below. This 
document is a compilation of device and documentation errata, specification clarifications and changes. It is 
intended for hardware system manufacturers and software developers of applications, operating systems, or 
tools. 


Affected Documents 


Document Title Bocknisnt NUMBERS 
Location 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture 253665 
Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 2A: Instruction Set 
253666 
Reference, A-L 
Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 2B: Instruction Set 
253667 
Reference, M-U 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2C: Instruction Set 326018 
Reference, V 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D: Instruction Set 
334569 
Reference, W-Z 
Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A: System 253668 
Programming Guide, Part 1 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B: System 
; ; 253669 
Programming Guide, Part 2 
Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3C: System 
; : 326019 
Programming Guide, Part 3 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3D: System 
; ; 332831 
Programming Guide, Part 4 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model Specific 335592 
Registers 
Nomenclature 


Documentation Changes include typos, errors, or omissions from the current published specifications. These 
will be incorporated in any new release of the specification. 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes ys 


Summary Tables of Changes 


The following table indicates documentation changes which apply to the Intel® 64 and IA-32 architectures. This 
table uses the following notations: 


Codes Used in Summary Tables 


A violet change bar to left of table row indicates this erratum is either new or modified from the previous version 
of the document. 


Documentation Changes 


DOCUMENTATION CHANGES 


z 
. 


Updates to Chapter 1, Volume 1 


Updates to Chapter 13, Volume 1 


Updates to Chapter 1, Volume 2A 


Updates to Chapter 2, Volume 2A 


Updates to Chapter 3, Volume 2A 


Updates to Chapter 4, Volume 2B 
Updates to Chapter 5, Volume 2C 
Updates to Chapter 1, Volume 3A 


WO] CO] N] DD] H] RB] W] NI] 


Updates to Chapter 2, Volume 3A 
10 Updates to Chapter 9, Volume 3A 
11 Updates to Chapter 12, Volume 3A 
12 Updates to Chapter 16, Volume 3B 
13 Updates to Chapter 19, Volume 3B 
14 Updates to Chapter 23, Volume 3B 
15 Updates to Chapter 25, Volume 3C 
16 Updates to Chapter 27, Volume 3C 
17 Updates to Chapter 28, Volume 3C 
18 Updates to Chapter 32, Volume 3C 
19 Updates to Chapter 1, Volume 4 
20 Updates to Chapter 2, Volume 4 
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Documentation Changes 


Changes to the Intel® 64 and IA-32 Architectures Software Developer’s Manual volumes follow, and are listed 
by chapter. Only chapters with changes are included in this document. 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 9 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 


10 


1. Updates to Chapter 1, Volume 1 


Change bars and violet text show changes to Chapter 1 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1: Basic Architecture. 


Changes to this chapter: 


e Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processors to 
the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.” 
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CHAPTER 1 
ABOUT THIS MANUAL 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (order number 
253665) is part of a set that describes the architecture and programming environment of Intel® 64 and IA-32 
architecture processors. Other volumes in this set are: 


¢ The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C & 2D: Instruction Set 
Reference (order numbers 253666, 253667, 326018, and 334569). 


* The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C & 3D: System 
Programming Guide (order numbers 253668, 253669, 326019, and 332831). 


* The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers (order 
number 335592). 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture 
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describe the instruction set of the processor and the opcode struc- 
ture. These volumes apply to application programmers and to programmers who write operating systems or exec- 
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describe 
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating- 
system and BIOS designers. In addition, the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3B, addresses the programming environment for classes of software that host operating systems. The 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, describes the model-specific registers 
of Intel 64 and IA-32 processors. 


1.1 INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL 


This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which 
include: 


* Pentium® processors 

° P6 family processors 

* Pentium® 4 processors 

* Pentium® M processors 

* Intel® Xeon® processors 

* Pentium® D processors 

* Pentium® processor Extreme Editions 

* 64-bit Intel® Xeon® processors 

* Intel® Core™ Duo processor 

* Intel® Core™ Solo processor 

* Dual-Core Intel® Xeon® processor LV 

* Intel® Core™ 2 Duo processor 

* Intel® Core™ 2 Quad processor Q6000 series 

* Intel® xeon® processor 3000, 3200 series 

* Intel® Xeon® processor 5000 series 

* Intel® xeon® processor 5100, 5300 series 

* Intel® Core™ 2 Extreme processor X7000 and X6800 series 
* Intel® Core™ 2 Extreme processor QX6000 series 
* Intel® Xeon® processor 7100 series 
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* Intel® Pentium® Dual-Core processor 

* Intel® Xeon® processor 7200, 7300 series 

* Intel® xeon® processor 5200, 5400, 7400 series 

* Intel® Core™ 2 Extreme processor QX9000 and X9000 series 
* Intel® Core™ 2 Quad processor Q9000 series 

* Intel® Core™ 2 Duo processor E8000, T9000 series 

* Intel Atom® processor family 


* Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are built from 45 nm and 32 nm processes 


* Intel® Core™ i7 processor 

* Intel® Core™ i5 processor 

* Intel® Xeon® processor E7-8800/4800/2800 product families 
* Intel® Core™ i7-3930K processor 

* 2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series 
* Intel® Xeon® processor E3-1200 product family 

* Intel® Xeon® processor E5-2400/1400 product family 

* Intel® Xeon® processor E5-4600/2600/1600 product family 
* 3rd generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1200 v2 product family 

* Intel® Xeon® processor E5-2400/1400 v2 product families 

* Intel® Xeon® processor E5-4600/2600/1600 v2 product families 
* Intel® Xeon® processor E7-8800/4800/2800 v2 product families 
* 4th generation Intel® Core™ processors 

* The Intel® Core™ M processor family 

* Intel® Core™ i7-59xx Processor Extreme Edition 

* Intel® Core™ i7-49xx Processor Extreme Edition 

* Intel® Xeon® processor E3-1200 v3 product family 

* Intel® Xeon® processor E5-2600/1600 v3 product families 

* 5th generation Intel® Core™ processors 

* Intel® Xeon® processor D-1500 product family 

* Intel® Xeon® processor E5 v4 family 

* Intel Atom® processor X7-Z8000 and X5-Z8000 series 

* Intel Atom® processor Z3400 series 

* Intel Atom® processor Z3500 series 

* 6th generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1500m v5 product family 

* 7th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series 

* Intel® Xeon® Scalable Processor Family 

* 8th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 

* Intel® Xeon® E processors 

* 9th generation Intel® Core™ processors 

* 2nd generation Intel® Xeon® Scalable Processor Family 
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* 10th generation Intel® Core™ processors 

* 11th generation Intel® Core™ processors 

* 3rd generation Intel® Xeon® Scalable Processor Family 
* 12th generation Intel® Core™ processors 

* 13th generation Intel® Core™ processors 

* 4th generation Intel® Xeon® Scalable Processor Family 
* 5th generation Intel® Xeon® Scalable Processor Family 
* Intel® Core™ Ultra 7 processors 


P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium® 
Pro, Pentium® II, Pentium® III, and Pentium® III Xeon® processors. 


The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® microar- 
chitecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon 
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture. 


The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved 
Pentium® M processor microarchitecture. 


The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Quad, and Intel® Core™ 2 Extreme processors are based on Intel® Core™ microar- 
chitecture. 


The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™ 2 Quad processor Q9000 series, and Intel® 
Core™ 2 Extreme processors QX9000, X9000 series, Intel® Core™ 2 processor E8000 series are based on 
Enhanced Intel® Core™ microarchitecture. 


The Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are based on the Intel Atom® microarchitecture and supports Intel 64 architecture. 


P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV, 
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® Atom™ 
processor Z5xx series support IA-32 architecture. 


The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Extreme, Intel® Core™ 2 Quad processors, Pentium® D processors, Pentium® Dual- 
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture. 


The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem 
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel® 
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the 
Westmere microarchitecture. These processors support Intel 64 architecture. 


The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7- 
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx, 
Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product 
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support 
Intel 64 architecture. 


The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2 
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec- 
ture and support Intel 64 architecture. 


The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on 
the Haswell microarchitecture and support Intel 64 architecture. 


The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme 
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture. 


The Intel Atom® processor Z8000 series is based on the Airmont microarchitecture. 
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The Intel Atom® processor Z3400 series and the Intel Atom® processor Z3500 series are based on the Silvermont 
microarchitecture. 


The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500 
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® Scalable Processor Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener- 
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture. 


The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64 
architecture. 


The Intel Atom® processor C series, the Intel Atom® processor X series, the Intel® Pentium® processor J series, 
the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Goldmont 
microarchitecture. 


The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and 
supports Intel 64 architecture. 


The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron® 
processor N series are based on the Goldmont Plus microarchitecture. 


The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces- 
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture. 


The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and 
supports Intel 64 architecture. 


The 2nd generation Intel® Xeon® Scalable Processor Family is based on the Cascade Lake product and supports 
Intel 64 architecture. 


Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based 
on the Comet Lake microarchitecture; both support Intel 64 architecture. 


Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are 
based on the Rocket Lake microarchitecture; both support Intel 64 architecture. 


Some 3rd generation Intel® Xeon® Scalable Processor Family processors are based on the Cooper Lake product, 
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture. 


The 12th generation Intel® Core™ processors are based on the Alder Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 13th generation Intel® Core™ processors are based on the Raptor Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and 
supports Intel 64 architecture. 


The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and 
supports Intel 64 architecture. 


The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and supports Intel 64 architecture. 


IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces- 
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset 
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture. 


1.2 OVERVIEW OF VOLUME 1: BASIC ARCHITECTURE 


A description of this manual’s content follows: 


Chapter 1 — About This Manual. Gives an overview of all volumes of the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual. It also describes the notational conventions in these manuals and lists related Intel 
manuals and documentation of interest to programmers and hardware designers. 
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Chapter 2 — Intel® 64 and IA-32 Architectures. Introduces the Intel 64 and IA-32 architectures along with 
the families of Intel processors that are based on these architectures. It also gives an overview of the common 
features found in these processors and brief history of the Intel 64 and IA-32 architectures. 


Chapter 3 — Basic Execution Environment. Introduces the models of memory organization and describes the 
register set used by applications. 


Chapter 4 — Data Types. Describes the data types and addressing modes recognized by the processor; provides 
an overview of real numbers and floating-point formats and of floating-point exceptions. 


Chapter 5 — Instruction Set Summary. Lists all Intel 64 and IA-32 instructions, divided into technology groups. 


Chapter 6 — Procedure Calls, Interrupts, and Exceptions. Describes the procedure stack and mechanisms 
provided for making procedure calls and for servicing interrupts and exceptions. 


Chapter 7 — Programming with General-Purpose Instructions. Describes basic load and store, program 
control, arithmetic, and string instructions that operate on basic data types, general-purpose and segment regis- 
ters; also describes system instructions that are executed in protected mode. 


Chapter 8 — Programming with the x87 FPU. Describes the x87 floating-point unit (FPU), including floating- 
point registers and data types; gives an overview of the floating-point instruction set and describes the processor's 
floating-point exception conditions. 


Chapter 9 — Programming with Intel® MMX™ Technology. Describes Intel MMX technology, including MMX 
registers and data types; also provides an overview of the MMX instruction set. 


Chapter 10 — Programming with Intel® Streaming SIMD Extensions (Intel® SSE). Describes SSE exten- 
sions, including XMM registers, the MXCSR register, and packed single precision floating-point data types; provides 
an overview of the SSE instruction set and gives guidelines for writing code that accesses the SSE extensions. 


Chapter 11 — Programming with Intel® Streaming SIMD Extensions 2 (Intel® SSE2). Describes SSE2 
extensions, including XMM registers and packed double precision floating-point data types; provides an overview 
of the SSE2 instruction set and gives guidelines for writing code that accesses SSE2 extensions. This chapter also 
describes SIMD floating-point exceptions that can be generated with SSE and SSE2 instructions. It also provides 
general guidelines for incorporating support for SSE and SSE2 extensions into operating system and applications 
code. 


Chapter 12 — Programming with Intel® Streaming SIMD Extensions 3 (Intel® SSE3), Supplemental 
Streaming SIMD Extensions 3 (SSSE3), Intel® Streaming SIMD Extensions 4 (Intel® SSE4) and Intel® 
AES New Instructions (Intel® AES-NI). Provides an overview of the SSE3 instruction set, Supplemental SSE3, 
SSE4, AESNI instructions, and guidelines for writing code that access these extensions. 


Chapter 13 — Managing State Using the XSAVE Feature Set. Describes the XSAVE feature set instructions 
and explains how software can enable the XSAVE feature set and XSAVE-enabled features. 


Chapter 14 — Programming with Intel® AVX, FMA, and Intel® AVX2. Provides an overview of the Intel® AVX 
instruction set, FMA, and Intel® AVX2 extensions and gives guidelines for writing code that access these exten- 
sions. 


Chapter 15 — Programming with Intel® AVX-512. Provides an overview of the Intel® AVX-512 instruction set 
extensions and gives guidelines for writing code that access these extensions. 


Chapter 16 — Programming with Intel® Transactional Synchronization Extensions. Describes the instruc- 
tion extensions that support lock elision techniques to improve the performance of multi-threaded software with 
contended locks. 


Chapter 17 — Control-flow Enforcement Technology. Provides an overview of the Control-flow Enforcement 
Technology (CET) and gives guidelines for writing code that access these extensions. 


Chapter 18 — Programming with Intel® Advanced Matrix Extensions. Provides an overview of the Intel® 
Advanced Matrix Extensions and gives guidelines for writing code that access these extensions. 


Chapter 19 — Input/Output. Describes the processor’s I/O mechanism, including I/O port addressing, I/O 
instructions, and I/O protection mechanisms. 


Chapter 20 — Processor Identification and Feature Determination. Describes how to determine the CPU 
type and features available in the processor. 
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Appendix A — EFLAGS Cross-Reference. Summarizes how the IA-32 instructions affect the flags in the EFLAGS 
register. 


Appendix B — EFLAGS Condition Codes. Summarizes how conditional jump, move, and ‘byte set on condition 
code’ instructions use condition code flags (OF, CF, ZF, SF, and PF) in the EFLAGS register. 


Appendix C — Floating-Point Exceptions Summary. Summarizes exceptions raised by the x87 FPU floating- 
point and SSE/SSE2/SSE3 floating-point instructions. 


Appendix D — Guidelines for Writing SIMD Floating-Point Exception Handlers. Gives guidelines for writing 
exception handlers for exceptions generated by SSE/SSE2/SSE3 floating-point instructions. 


Appendix E — Intel® Memory Protection Extensions. Provides an overview of the Intel® Memory Protection 
Extensions, a feature that has been deprecated and will not be available on future processors. 


1.3 NOTATIONAL CONVENTIONS 


This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for 
hexadecimal and binary numbers. This notation is described below. 


1.3.1 Bit and Byte Order 


In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses 
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to 
two raised to the power of the bit position. Intel 64 and IA-32 processors are “little endian” machines; this means 
the bytes of a word are numbered starting from the least significant byte. See Figure 1-1. 


Highest Data Structure 
Address 31 24 23 16 15 87 0 <— Bit offset 


Lowest 
Address 


Byte Offset 


Figure 1-1. Bit and Byte Order 


1.3.2 Reserved Bits and Software Compatibility 


In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as 
reserved, it is essential for compatibility with future processors that software treat these bits as having a future, 
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict- 
able. 


Software should follow these guidelines in dealing with reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers that contain such bits. 
Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 
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¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, 
or reload them with values previously read from the same register. 


NOTE 


Avoid any software dependence upon the state of reserved bits in Intel 64 and IA-32 registers. 
Depending upon the values of reserved register bits will make software dependent upon the 
unspecified manner in which the processor handles these bits. Programs that depend upon 
reserved values risk incompatibility with future processors. 


1.3.2.1 Instruction Operands 


When instructions are represented symbolically, a subset of the IA-32 assembly language is used. In this subset, 
an instruction has the following format: 
label: mnemonic argument1, argument2, argument3 
where: 
° A label is an identifier which is followed by a colon. 
¢ Amnemonic is a reserved name for a class of instruction opcodes which have the same function. 


¢ The operands argumenti, argument2, and arguments3 are optional. There may be from zero to three 
operands, depending on the opcode. When present, they take the form of either literals or identifiers for data 
items. Operand identifiers are either reserved names of registers or are assumed to be assigned to data items 
declared in another part of the program (which may not be shown in the example). 


When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left 
operand is the destination. 


For example: 


LOADREG: MOV EAX, SUBTOTAL 


In this example, LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand, 
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order. 


1.3.3 Hexadecimal and Binary Numbers 


Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for 
example, OF82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, 
E, and F. 


Base 2 (binary) numbers are represented by a string of 1s and 0s, sometimes followed by the character B (for 
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might 
arise. 


1.3.4 Segmented Addressing 


The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes. 
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes memory. The 
range of memory that can be addressed is called an address space. 


The processor also supports segmented addressing. This is a form of addressing where a program may have many 
independent address spaces, called segments. For example, a program can keep its code (instructions) and stack 
in separate segments. Code addresses would always refer to the code space, and stack addresses would always 
refer to the stack space. The following notation is used to specify a byte address within a segment: 


Segment-register:Byte-address 


For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS 
register: 
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DS:FF79H 
The following segment address identifies an instruction address in the code segment. The CS register points to the 
code segment and the EIP register contains the address of the instruction. 


CS:EIP 


1.3.5 A New Syntax for CPUID, CR, and MSR Values 


Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register 
bits, and by reading model-specific registers. We are moving toward a new syntax to represent this information. 
See Figure 1-2. 


CPUID Input and Output 
CPUID.01H:EDX.SSE[bit 25] = 1 


Input value for EAX register 


Output register and feature flag or field 
name with bit position(s) 


Value (or range) of output 


Control Register Values 


CR4.OSFXSR)bit 9] = 1 


Example CR name 


Feature flag or field name 
with bit position(s) 


Value (or range) of output 


Model-Specific Register Values 


IA32_MISC_ENABLE.ENABLEFOPCODE[bit 2] = 1 
, 


Example MSR name 


Feature flag or field name with bit position(s) 


Value (or range) of output 


Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation 


1.3.6 Exceptions 


An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to 
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi- 
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tions. Some types of exceptions may provide error codes. An error code reports additional information about the 


error. An example of the notation used to show an exception and error code is shown below: 


#PF(fault code) 
This example refers to a page-fault exception under conditions where an error code naming a type of fault is 


reported. Under some conditions, exceptions that produce error codes may not be able to report an accurate code. 


In this case, the error code is zero, as shown below for a general-protection exception: 


#GP(0) 


1.4 RELATED LITERATURE 


Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at: 
https://software.intel.com/en-us/articles/intel-sdm 
See also: 


* The latest security information on Intel® products: 
https://www.intel.com/content/www/us/en/security-center/default.html 


° Software developer resources, guidance, and insights for security advisories: 
https://software.intel.com/security-software-guidance/ 


¢ The data sheet for a particular Intel 64 or IA-32 processor 
° The specification update for a particular Intel 64 or IA-32 processor 


* Intel® C++ Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


* Intel® Fortran Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


* Intel® Software Development Tools: 
https://software.intel.com/en-us/intel-sdp-home 


* Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four or ten volumes): 
https://software.intel.com/en-us/articles/intel-sdm 


* Intel® 64 and IA-32 Architectures Optimization Reference Manual: 
https://software.intel.com/en-us/articles/intel-sdm#optimization 


* Intel® Trusted Execution Technology Measured Launched Environment Programming Guide: 


http://www. intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html 


* Intel® Software Guard Extensions (Intel® SGX) Information: 
https://software.intel.com/en-us/isa-extensions/intel-sgx 


® Developing Multi-threaded Applications: A Platform Consistent Approach: 
https://software.intel.com/sites/default/files/article/147714/51534-developing-multithreaded-applica- 
tions. pdf 


* Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor: 
https://software.intel.com/sites/default/files/22/30/25602 


¢ Performance Monitoring Unit Sharing Guide: 
http://software.intel.com/file/30388 


Literature related to select features in future Intel processors are available at: 


* Intel® Architecture Instruction Set Extensions Programming Reference: 
https://software.intel.com/en-us/isa-extensions 


More relevant links are: 
* Intel® Developer Zone: 
https://software.intel.com/en-us 
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° Developer centers: 

http://www. intel.com/content/www/us/en/hardware-developers/developer-centers.html 
® Processor support general link: 

http://www. intel.com/support/processors/ 
* Intel® Hyper-Threading Technology (Intel® HT Technology): 

http://www. intel.com/technology/platform-technology/hyper-threading/index.htm 
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2. Updates to Chapter 13, Volume 1 


Change bars and violet text show changes to Chapter 13 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1: Basic Architecture. 


Changes to this chapter: 


e XFD updates made to Section 13.13, ‘Memory Accesses by the XSAVE Feature Set,” and Section 13.14, 
“Extended Feature Disable (XFD).” 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 
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CHAPTER 13 
MANAGING STATE USING THE XSAVE FEATURE SET 


The XSAVE feature set extends the functionality of the FXSAVE and FXRSTOR instructions (see Section 10.5, 
“FXSAVE and FXRSTOR Instructions”) by supporting the saving and restoring of processor state in addition to the 
x87 execution environment (x87 state) and the registers used by the streaming SIMD extensions (SSE state). 


The XSAVE feature set comprises eight instructions. XGETBV and XSETBV allow software to read and write the 
extended control register XCRO, which controls the operation of the XSAVE feature set. XSAVE, XSAVEOPT, 
XSAVEC, and XSAVES are four instructions that save processor state to memory; XRSTOR and XRSTORS are corre- 
sponding instructions that load processor state from memory. XGETBV, XSAVE, XSAVEOPT, XSAVEC, and XRSTOR 
can be executed at any privilege level; XSETBV, XSAVES, and XRSTORS can be executed only if CPL = 0. In addition 
to XCRO, the XSAVES and XRSTORS instructions are controlled also by the IA32_XSS MSR (index DAOH). 


The XSAVE feature set organizes the state that manages into state components. Operation of the instructions is 
based on state-component bitmaps that have the same format as XCRO and as the IA32_XSS MSR: each bit 
corresponds to a state component. Section 13.1 discusses these state components and bitmaps in more detail. 


Section 13.2 describes how the processor enumerates support for the XSAVE feature set and for XSAVE-enabled 
features (those features that require the use of the XSAVE feature set for their enabling). Section 13.3 explains 
how software can enable the XSAVE feature set and XSAVE-enabled features. 


The XSAVE feature set allows saving and loading processor state from a region of memory called an XSAVE area. 
Section 13.4 presents details of the XSAVE area and its organization. Each XSAVE-managed state component is 
associated with a section of the XSAVE area. Section 13.5 describes in detail each of the XSAVE-managed state 
components. 


Section 13.7 through Section 13.12 describe the operation of XSAVE, XRSTOR, XSAVEOPT, XSAVEC, XSAVES, and 
XRSTORS, respectively. 


Section 13.13 provides some details about memory accesses performed by instructions in the XSAVE feature set, 
and Section 13.14 describes a facility called extended feature disable (XFD). 


13.1. XSAVE-SUPPORTED FEATURES AND STATE-COMPONENT BITMAPS 


The XSAVE feature set supports the saving and restoring of state components, each of which is a discrete set of 
processor registers (or parts of registers). In general, each such state component corresponds to a particular CPU 
feature. Such a feature is XSAVE-supported. Some XSAVE-supported features use registers in multiple XSAVE- 
managed state components. 


The XSAVE feature set organizes the state components of the XSAVE-supported features using state-component 
bitmaps. A state-component bitmap comprises 64 bits; each bit in such a bitmap corresponds to a single state 
component. The following bits are defined in state-component bitmaps (details on individual state components are 
provided in subsections of Section 13.5): 


¢ Bit 0 corresponds to the state component used for the x87 FPU execution environment (x87 state). 


¢ Bit 1 corresponds to the state component used for registers used by the streaming SIMD extensions (SSE 
state). 


* Bit 2 corresponds to the state component used for the additional register state used by the Intel® Advanced 
Vector Extensions (AVX state). 


* Bits 4:3 correspond to the two state components used for the additional register state used by Intel® Memory 
Protection Extensions (MPX state): 


— State component 3 is used for the 4 128-bit bounds registers BNDO-BND3 (BNDREGS state). 


— State component 4 is used for the 64-bit user-mode MPX configuration register BNDCFGU and the 64-bit 
MPX status register BNDSTATUS (BNDCSR state). 


* Bits 7:5 correspond to the three state components used for the additional register state used by Intel® 
Advanced Vector Extensions 512 (AVX-512 state): 
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— State component 5 is used for the 8 64-bit opmask registers kKO-k7 (opmask state). 


— State component 6 is used for the upper 256 bits of the registers ZMMO-ZMM15. These 16 256-bit values 
are denoted ZMMO_H-ZMM15_H (ZMM_Hi256 state). 


— State component 7 is used for the 16 512-bit registers ZMM16-ZMM31 (Hi16_ZMM state). 
¢ Bit 8 corresponds to the state component used for the Intel Processor Trace MSRs (PT state). 
¢ Bit 9 corresponds to the state component used for the protection-key feature’s register PKRU (PKRU state). 


¢ Bit 10 corresponds to the state component used for the IA32_PASID MSR used by the ENQCMD instruction for 
a process address space identifiers (PASID state). 


¢ Bits 12:11 correspond to the two state components used for the additional register state used by Control-Flow 
Enforcement Technology (CET state): 


— State component 11 is used for the 2 MSRs controlling user-mode functionality for CET (CET_U state). 


— State component 12 is used for the 3 MSRs containing shadow-stack pointers for privilege levels 0-2 
(CET_S state). 


¢ Bit 13 corresponds to the state component used for an MSR used to control hardware duty cycling (HDC 
state). 


¢ Bit 14 corresponds to the state component used for user interrupts (UINTR state). 
¢ Bit 15 corresponds to the state component used for last-branch record configuration (LBR state). 
¢ Bit 16 corresponds to the state component used for an MSR used to control hardware P-states (HWP state). 


* Bits 18:17 correspond to the two state components used for the additional register state used by Intel® 
Advanced Matrix Extensions (AMX state): 


— State component 17 is used for the 64-byte TILECFG register (TILECFG state). 
— State component 18 is used for the 8192 bytes of tile data (TILEDATA state). 


Bits in the range 62:19 are not currently defined in state-component bitmaps and are reserved for future expan- 
sion. As individual state components are defined using those bits, additional sub-sections will be updated within 
Section 13.5 over time. Bit 63 is used for special functionality in some bitmaps and does not correspond to any 
state component. 


The state component corresponding to bit / of state-component bitmaps is called state component /. Thus, x87 
state is state component 0; SSE state is state component 1; AVX state is state component 2; MPX state comprises 
state components 3-4; AVX-512 state comprises state components 5-7; PT state is state component 8; PKRU state 
is state component 9; PASID state is state component 10; CET state comprises state components 11-12; HDC 
state is state component 13; UINTR state is state component 14; LBR state is state component 15; HWP state is 
state component 16; AMX state comprises state components 17-18. 


The XSAVE feature set uses state-component bitmaps in multiple ways. Most of the instructions use an implicit 
operand (in EDX:EAX), called the instruction mask, which is the state-component bitmap that specifies the state 
components on which the instruction operates. 


Some state components are user state components, and they can be managed by the entire XSAVE feature set. 
Other state components are supervisor state components, and they can be managed only by XSAVES and 
XRSTORS. The state components corresponding to bit 9, to bits 18:17, and to bits in the range 7:0 are user state 
components; those corresponding to bit 8, to bits in the range 13:10, and to bits 16:14 are supervisor state 
components. 


Extended control register XCRO contains a state-component bitmap that specifies the user state components that 
software has enabled the XSAVE feature set to manage. If the bit corresponding to a state component is clear in 
XCRO, instructions in the XSAVE feature set will not operate on that state component, regardless of the value of the 
instruction mask. 


The IA32_XSS MSR (index DAOH) contains a state-component bitmap that specifies the supervisor state compo- 
nents that software has enabled XSAVES and XRSTORS to manage (XSAVE, XSAVEC, XSAVEOPT, and XRSTOR 
cannot manage supervisor state components). If the bit corresponding to a state component is clear in the 
IA32_XSS MSR, XSAVES and XRSTORS will not operate on that state component, regardless of the value of the 
instruction mask. 
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Some XSAVE-supported features can be used only if XCRO has been configured so that the features’ state compo- 
nents can be managed by the XSAVE feature set. (This applies only to features with user state components.) Such 
state components and features are XSAVE-enabled. In general, the processor will not modify (or allow modifica- 
tion of) the registers of a state component of an XSAVE-enabled feature if the bit corresponding to that state 
component is clear in XCRO. (If software clears such a bit in XCRO, the processor preserves the corresponding state 
component.) If an XSAVE-enabled feature has not been fully enabled in XCRO, execution of any instruction defined 
for that feature causes an invalid-opcode exception (#UD). 


As will be explained in Section 13.3, the XSAVE feature set is enabled only if CR4.OSXSAVE[bit 18] = 1. If 
CR4.OSXSAVE = 0, the processor treats XSAVE-enabled state features and their state components as if all bits in 
XCRO were clear; the state components cannot be modified and the features’ instructions cannot be executed. 


The state components for x87 state, for SSE state, for PT state, for PKRU state, for PASID state, for CET state, for 
HDC state, for UINTR state, for LBR state, and for HWP state are XSAVE-managed but the corresponding features 
are not XSAVE-enabled. Processors allow modification of this state, as well as execution of x87 FPU instructions 
and SSE instructions and use of Intel Processor Trace, protection keys, the ENQCMD instruction and the 
IA32_PASID MSR, CET, hardware duty cycling, user interrupts, LBRs, and hardware P-states, regardless of the 
value of CR4.O0SXSAVE and XCRO. 


13.2 © ENUMERATION OF CPU SUPPORT FOR XSAVE INSTRUCTIONS AND XSAVE- 
SUPPORTED FEATURES 


A processor enumerates support for the XSAVE feature set and for features supported by that feature set using the 
CPUID instruction. The following items provide specific details: 


¢ CPUID.1:ECX.XSAVE[bit 26] enumerates general support for the XSAVE feature set: 


— If this bit is 0, the processor does not support any of the following instructions: XGETBV, XRSTOR, 
XRSTORS, XSAVE, XSAVEC, XSAVEOPT, XSAVES, and XSETBV; the processor provides no further 
enumeration through CPUID function ODH (see below). 


— If this bit is 1, the processor supports the following instructions: XGETBV, XRSTOR, XSAVE, and XSETBV.! 
Further enumeration is provided through CPUID function ODH. 


CR4.OSXSAVE can be set to 1 if and only if CPUID.1:ECX.XSAVE[bit 26] is enumerated as 1. 


¢ CPUID function ODH enumerates details of CPU support through a set of sub-functions. Software selects a 
specific sub-function by the value placed in the ECX register. The following items provide specific details: 


— CPUID function ODH, sub-function 0. 


¢ EDX:EAX is a bitmap of all the user state components that can be managed using the XSAVE feature 
set. A bit can be set in XCRO if and only if the corresponding bit is set in this bitmap. Every processor 
that supports the XSAVE feature set will set EAX[0] (x87 state) and EAX[1] (SSE state). 
If EAX[/] = 1 (for 1 <i < 32) or EDX[/-32] = 1 (for 32 < i < 63), sub-function / enumerates details for 
state component / (see below). 

¢ ECX enumerates the size (in bytes) required by the XSAVE instruction for an XSAVE area containing all 
the user state components supported by this processor. 


¢ EBX enumerates the size (in bytes) required by the XSAVE instruction for an XSAVE area containing all 
the user state components corresponding to bits currently set in XCRO. 


— CPUID function ODH, sub-function 1. 


¢ EAX[0] enumerates support for the XSAVEOPT instruction. The instruction is supported if and only if 
this bit is 1. If EAX[O0] = 0, execution of XSAVEOPT causes an invalid-opcode exception (#UD). 


¢ EAX[1] enumerates support for compaction extensions to the XSAVE feature set. The following are 
supported if this bit is 1: 


1. If CPUID.1:ECX.XSAVE[bit 26] = 1, XGETBV and XSETBV may be executed with ECX = 0 (to read and write XCRO). Any support for 
execution of these instructions with other values of ECX is enumerated separately. 
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— The compacted format of the extended region of XSAVE areas (see Section 13.4.3). 
— The XSAVEC instruction. If EAX[1] = 0, execution of XSAVEC causes a #UD. 
— Execution of the compacted form of XRSTOR (see Section 13.8). 


¢ EAX[2] enumerates support for execution of XGETBV with ECX = 1. This allows software to determine 
the state of the init optimization. See Section 13.6. 


¢ EAX[3] enumerates support for XSAVES, XRSTORS, and the IA32_XSS MSR. If EAX[3] = 0, execution 
of XSAVES or XRSTORS causes a #UD; an attempt to access the IA32_XSS MSR using RDMSR or 
WRMSR causes a general-protection exception (#GP). Every processor that supports a supervisor state 
component sets EAX[3]. Every processor that sets EAX[3] (XSAVES, XRSTORS, IA32_XSS) will also set 
EAX[1] (the compaction extensions). 


¢ EAX[4] enumerates general support for extended feature disable (XFD). See Section 13.14 for details. 
¢ EAX[31:5] are reserved. 
¢ EBX enumerates the size (in bytes) defined as follows: 


— If EAX[3] is enumerated as 1, EBX enumerates the size required by the XSAVES instruction for an 
XSAVE area containing all the state components corresponding to bits currently set in XCRO | 
IA32_XSS. 


— If EAX[3] is enumerated as 0 and EAX[1] is enumerated as 1, EBX enumerates the size required by 
the XSAVEC instruction for an XSAVE area containing all the state components corresponding to bits 
currently set in XCRO. 


— If EAX[1] and EAX[3] are both enumerated as 0, EBX enumerates zero. 


¢ EDX:ECX is a bitmap of all the supervisor state components that can be managed by XSAVES and 
XRSTORS. A bit can be set in the IA32_XSS MSR if and only if the corresponding bit is set in this bitmap. 


NOTE 


In summary, the XSAVE feature set supports state component / (0 < / < 63) if one of the following 
is true: (1) i < 32 and CPUID.(EAX=0DH,ECX=0):EAX[/] = 1; (2) i = 32 and 
CPUID.(EAX=0DH,ECX=0):EAX[i-32] = 1; (3) i < 32 and CPUID.(EAX=0DH,ECX=1):ECX[/] = 1; 
or (4) i = 32 and CPUID.(EAX=0DH,ECX=1):EDX[/-32] = 1. The XSAVE feature set supports user 
state component / if (1) or (2) holds; if (3) or (4) holds, state component / is a supervisor state 
component and support is limited to XSAVES and XRSTORS. 


— CPUID function ODH, sub-function / (i > 1). This sub-function enumerates details for state component /. If 
the XSAVE feature set supports state component / (see note above), the following items provide specific 
details: 


¢ EAX enumerates the size (in bytes) required for state component /. 


¢ If state component / is a user state component, EBX enumerates the offset (in bytes, from the base of 
the XSAVE area) of the section used for state component /. (This offset applies only when the standard 
format for the extended region of the XSAVE area is being used; see Section 13.4.3.) 


¢ If state component / is a supervisor state component, EBX returns 0. 


¢ If state component / is a user state component, ECX[0] return 0; if state component / is a supervisor 
state component, ECX[0] returns 1. 


¢ The value returned by ECX[1] indicates the alignment of state component / when the compacted format 
of the extended region of an XSAVE area is used (see Section 13.4.3). If ECX[1] returns 0, state 
component / is located immediately following the preceding state component; if ECX[1] returns 1, state 
component / is located on the next 64-byte boundary following the preceding state component. 


¢ If the processor supports XFD for state component /, ECX[2] returns 1; otherwise, ECX[2] returns 0. 
¢ ECX[31:3] and EDX return 0. 


If the XSAVE feature set does not support state component /, sub-function / returns 0 in EAX, EBX, ECX, and 
EDX. 
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13.3. ENABLING THE XSAVE FEATURE SET AND XSAVE-ENABLED FEATURES 


Software enables the XSAVE feature set by setting CR4.OSXSAVE[bit 18] to 1 (e.g., with the MOV to CR4 instruc- 
tion). If this bit is 0, execution of any of XGETBV, XRSTOR, XRSTORS, XSAVE, XSAVEC, XSAVEOPT, XSAVES, and 
XSETBV causes an invalid-opcode exception (#UD). 


When CR4.0SXSAVE = 1 and CPL = 0, executing the XSETBV instruction with ECX = 0 writes the 64-bit value in 
EDX:EAX to XCRO (EAX is written to XCRO[31:0] and EDX to XCRO[63:32]). (Execution of the XSETBV instruction 
causes a general-protection fault — #GP — if CPL > 0.) The following items provide details regarding individual bits 
in XCRO: 


¢  XCRO[0] is associated with x87 state (see Section 13.5.1). XCRO[O] is always 1. It has that value coming out of 
RESET. Executing the XSETBV instruction causes a general-protection fault (#GP) if ECX = 0 and EAX[0] is 0. 


¢  XCRO[1] is associated with SSE state (see Section 13.5.2). Software can use the XSAVE feature set to manage 
SSE state only if XCRO[1] = 1. The value of XCRO[1] in no way determines whether software can execute SSE 
instructions (these instructions can be executed even if XCRO[1] = 0). 


XCRO[1] is 0 coming out of RESET. As noted in Section 13.2, every processor that supports the XSAVE feature 
set allows software to set XCRO[1]. 


°  XCRO[2] is associated with AVX state (see Section 13.5.3). Software can use the XSAVE feature set to manage 
AVX state only if XCRO[2] = 1. In addition, software can execute Intel AVX instructions only if CR4.OSXSAVE = 
XCRO[2] = 1. Otherwise, any execution of an Intel AVX instruction causes an invalid-opcode exception (#UD). 


XCRO[2] is 0 coming out of RESET. As noted in Section 13.2, a processor allows software to set XCRO[2] if and 

only if CPUID.(EAX=0DH,ECX=0):EAX[2] = 1. In addition, executing the XSETBV instruction causes a general- 
protection fault (#GP) if ECX = 0 and EAX[2:1] has the value 10b; that is, software cannot enable the XSAVE 

feature set for AVX state but not for SSE state. 


As noted in Section 13.1, the processor will preserve AVX state unmodified if software clears XCRO[2]. 
However, clearing XCRO[2] while AVX state is not in its initial configuration may cause SSE instructions to incur 
a power and performance penalty. See Section 14.5.3, “Enable the Use Of XSAVE Feature Set And XSAVE State 
Components,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for how 
system software can avoid this penalty. 


°  XCRO[4:3] are associated with MPX state (see Section 13.5.4). Software can use the XSAVE feature set to 
manage MPxX state only if XCRO[4:3] = 11b. In addition, MPX instructions operate as defined only if 
CR4.OSXSAVE = 1 and XCRO[4:3] = 11b. Otherwise, execution of an MPX instruction causes no operation (as 
a NOP instruction); in addition, executions of CALL, RET, JMP, and Jcc do not initialize the bounds registers, and 
they ignore any F2H (BND) prefix.? 


XCRO[4:3] have value 00b coming out of RESET. As noted in Section 13.2, a processor allows software to set 
XCRO[4:3] to 11b if and only if CPUID.(EAX=0DH,ECX=0):EAX[4:3] = 11b. In addition, executing the XSETBV 
instruction causes a general-protection fault (#GP) if ECX = 0, EAX[4:3] is neither 00b nor 11b; that is, 
software can enable the XSAVE feature set for MPX state only if it does so for both state components. 


As noted in Section 13.1, the processor will preserve MPX state unmodified if software clears XCRO[4:3]. 


¢ XCRO[7:5] are associated with AVX-512 state (see Section 13.5.5). Software can use the XSAVE feature set to 
manage AVX-512 state only if XCRO[7:5] = 111b. In addition, software can execute Intel AVX-512 instructions 
only if CR4.0SXSAVE = 1 and XCRO[7:5] = 111b. Otherwise, any execution of an Intel AVX-512 instruction 
causes an invalid-opcode exception (#UD). 


XCRO[7:5] have value 000b coming out of RESET. As noted in Section 13.2, a processor allows software to set 
XCRO[7:5] to 111b if and only if CPUID.(EAX=0DH,ECX=0):EAX[7:5] = 111b. In addition, executing the 
XSETBV instruction causes a general-protection fault (#GP) if ECX = 0, EAX[7:5] is not 000b, and any bit is 
clear in EAX[2:1] or EAX[7:5]; that is, software can enable the XSAVE feature set for AVX-512 state only if it 
does so for all three state components, and only if it also does so for AVX state and SSE state. This implies that 
the value of XCRO[7:5] is always either 000b or 111b. 


As noted in Section 13.1, the processor will preserve AVX-512 state unmodified if software clears XCRO[7:5]. 
However, clearing XCRO[7:5] while AVX-512 state is not in its initial configuration may cause SSE and Intel AVX 
instructions to incur a power and performance penalty. See Section 14.5.3, “Enable the Use Of XSAVE Feature 


1. Prior to the introduction of MPX, the opcodes defining MPX instructions operated as NOP, and the CALL, RET, JMP, and Jcc instruc- 
tions ignored any F2H prefix. 


Vol.1 13-5 


MANAGING STATE USING THE XSAVE FEATURE SET 


Set And XSAVE State Components,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A, for how system software can avoid this penalty. 


¢ XCRO[9] is associated with PKRU state (see Section 13.5.7). Software can use the XSAVE feature set to 
manage PKRU state only if XCRO[9] = 1. The value of XCRO[9] in no way determines whether software can use 
protection keys or execute other instructions that access PKRU state (these instructions can be executed even 
if XCRO[9] = 0). 


XCRO[9] is 0 coming out of RESET. As noted in Section 13.2, a processor allows software to set XCRO[9] if and 
only if CPUID.(EAX=0DH,ECX=0):EAX[9] = 1. 


¢  XCRO[18:17] are associated with AMX state (see Section 13.5.5). Software can use the XSAVE feature set to 
manage AMX state only if XCRO[18:17] = 11b. In addition, software can execute Intel AMX instructions only if 
CR4.OSXSAVE = 1 and XCRO[18:17] = 11b. Otherwise, any execution of an Intel AMX instruction causes an 
invalid-opcode exception (#UD). 


XCRO[18:17] have value 00b coming out of RESET. As noted in Section 13.2, a processor allows software to set 
XCRO[18:17] to 11b if and only if CPUID.(EAX=0DH,ECX=0):EAX[18:17] = 11b. In addition, executing the 

XSETBV instruction causes a general-protection fault (#GP) if ECX = 0 and EAX[17] # EAX[18] (TILECFG and 
TILEDATA must be enabled together). This implies that the value of XCRO[18:17] is always either 00b or 11b. 


While Intel AMX instructions can be executed only in 64-bit mode, instructions of the XSAVE feature set can 
operate on TILECFG and TILEDATA in any mode. It is recommended that only 64-bit operating systems enable 
Intel AMX by setting XCRO[18:17]. 


* XCRO[63:19], XCRO[16:10], and XCRO[8] are reserved.! Executing the XSETBV instruction causes a general- 
protection fault (#GP) if ECX = 0 and any corresponding bit in EDX:EAX is not 0. These bits in XCRO are all 0 
coming out of RESET. 


Software operating with CPL > 0 may need to determine whether the XSAVE feature set and certain XSAVE- 
enabled features have been enabled. If CPL > 0, execution of the MOV from CR4 instruction causes a general- 
protection fault (#GP). The following alternative mechanisms allow software to discover the enabling of the XSAVE 
feature set regardless of CPL: 


¢ The value of CR4.OSXSAVE is returned in CPUID.1:ECX.OSXSAVE[bit 27]. If software determines that 
CPUID.1:ECX.OSXSAVE = 1, the processor supports the XSAVE feature set and the feature set has been 
enabled in CR4. 


¢ Executing the XGETBV instruction with ECX = 0 returns the value of XCRO in EDX:EAX. XGETBV can be 
executed if CR4.OSXSAVE = 1 (if CPUID.1:ECX.OSXSAVE = 1), regardless of CPL. 


Thus, software can use the following algorithm to determine the support and enabling for the XSAVE feature set: 
1. Use CPUID to discover the value of CPUID.1:ECX.OSXSAVE. 


— Ifthe bit is 0, either the XSAVE feature set is not supported by the processor or has not been enabled by 
software. Either way, the XSAVE feature set is not available, nor are XSAVE-enabled features such as AVX. 


— Ifthe bit is 1, the processor supports the XSAVE feature set — including the XGETBV instruction — and it 
has been enabled by software. The XSAVE feature set can be used to manage x87 state (because XCRO[0] 
is always 1). Software requiring more detailed information can go on to the next step. 


2. Execute XGETBV with ECX = 0 to discover the value of XCRO. If XCRO[1] = 1, the XSAVE feature set can be 
used to manage SSE state. If XCRO[2] = 1, the XSAVE feature set can be used to manage AVX state and 
software can execute Intel AVX instructions. If XCRO[4:3] is 11b, the XSAVE feature set can be used to manage 
MPX state and software can execute Intel MPX instructions. If XCRO[7:5] is 111b, the XSAVE feature set can be 
used to manage AVX-512 state and software can execute Intel AVX-512 instructions. If XCRO[9] = 1, the 
XSAVE feature set can be used to manage PKRU state. 


The IA32_XSS MSR (with MSR index DAOH) is zero coming out of RESET. If CR4.0OSXSAVE = 1, 
CPUID.(EAX=0DH,ECX=1):EAX[3] = 1, and CPL = 0, executing the WRMSR instruction with ECX = DAOH writes 
the 64-bit value in EDX:EAX to the IA32_XSS MSR (EAxX is written to IA32_XSS[31:0] and EDX to 
IA32_XSS[63:32]). The following items provide details regarding individual bits in the IA32_XSS MSR: 


1. Bit 8 and bits 16:10 correspond to supervisor state components. Since bits can be set in XCRO only for user state components, those 
bits of XCRO must be 0. 
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IA32_XSS[8] is associated with PT state (see Section 13.5.6). Software can use XSAVES and XRSTORS to 
manage PT state only if IA32_XSS[8] = 1. The value of IA32_XSS[8] does not determine whether software can 
use Intel Processor Trace (the feature can be used even if IA32_XSS[8] = 0). 


IA32_XSS[10] is associated with PASID state (see Section 13.5.8). Software can use the XSAVES and 
XRSTORS to manage PASID state only if IA32_XSS[10] = 1. The value of IA32_XSS[10] does not determine 
whether software can use the ENQCMD instruction, which uses the IA32_PASID MSR. (ENQCMD can be used 
even if IA32_XSS[10] is 0.) 


IA32_XSS[12:11] are associated with CET state (see Section 13.5.9), IA32_XSS[11] with CET_U state and 
IA32_XSS[12] with CET_S state. Software can use the XSAVES and XRSTORS to manage CET_U state (respec- 
tively, CET_S state) only if IA32_XSS[11] = 1 (respectively, IA32_XSS[12] = 1). The value of 
IA32_XSS[12:11] does not determine whether software can use CET (the feature can be used even if either of 
IA32_XSS[12:11] is 0). 


IA32_XSS[13] is associated with HDC state (see Section 13.5.10). Software can use XSAVES and XRSTORS to 
manage HDC state only if IA32_XSS[13] = 1. The value of IA32_XSS[13] does not determine whether software 
can use hardware duty cycling (the feature can be used even if IA32_XSS[13] = 0). 


IA32_XSS[14] is associated with UINTR state (see Section 13.5.11). Software can use XSAVES and XRSTORS 
to manage UINTR state only if IA32_XSS[14] = 1. The value of IA32_XSS[14] does not determine whether 
software can use user interrupts (the feature can be used even if IA32_XSS[14] = 0). 


IA32_XSS[15] is associated with LBR state (see Section 13.5.12). Software can use XSAVES and XRSTORS to 
manage LBR state only if IA32_XSS[15] = 1. The value of IA32_XSS[15] does not determine whether software 
can use LBRs (the feature can be used even if IA32_XSS[15] = 0). 


IA32_XSS[16] is associated with HWP state (see Section 13.5.13). Software can use XSAVES and XRSTORS to 
manage HWP state only if IA32_XSS[16] = 1. The value of IA32_XSS[16] does not determine whether 
software can use hardware P-states (the feature can be used even if IA32_XSS[16] = 0). 


IA32_XSS[63:17], IA32_XSS[9] and IA32_XSS[7:0] are reserved.! Executing the WRMSR instruction causes 


a general-protection fault (#GP) if ECX = DAOH and any corresponding bit in EDX:EAX is not 0. These bits in 
XCRO are all 0 coming out of RESET. 


The IA32_XSS MSR is 0 coming out of RESET. 
There is no mechanism by which software operating with CPL > 0 can discover the value of the IA32_XSS MSR. 


13.4 XSAVE AREA 


The XSAVE feature set includes instructions that save and restore the XSAVE-managed state components to and 
from memory: XSAVE, XSAVEOPT, XSAVEC, and XSAVES (for saving); and XRSTOR and XRSTORS (for restoring). 
The processor organizes the state components in a region of memory called an XSAVE area. Each of the save and 
restore instructions takes a memory operand that specifies the 64-byte aligned base address of the XSAVE area on 
which it operates. 


Every XSAVE area has the following format: 


The legacy region. The legacy region of an XSAVE area comprises the 512 bytes starting at the area’s base 
address. It is used to manage the state components for x87 state and SSE state. The legacy region is described 
in more detail in Section 13.4.1. 


The XSAVE header. The XSAVE header of an XSAVE area comprises the 64 bytes starting at an offset of 512 
bytes from the area’s base address. The XSAVE header is described in more detail in Section 13.4.2. 


The extended region. The extended region of an XSAVE area starts at an offset of 576 bytes from the area’s 
base address. It is used to manage the state components other than those for x87 state and SSE state. The 
extended region is described in more detail in Section 13.4.3. The size of the extended region is determined by 
which state components the processor supports and which bits have been set in XCRO and IA32_XSS (see 
Section 13.3). 


Bit 9 and bits 7:0 correspond to user state components. Since bits can be set in the IA32_XSS MSR only for supervisor state compo- 
nents, those bits of the MSR must be 0. 
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13.4.1 | Legacy Region of an XSAVE Area 


The legacy region of an XSAVE area comprises the 512 bytes starting at the area’s base address. It has the same 
format as the FXSAVE area (see Section 10.5.1). The XSAVE feature set uses the legacy area for x87 state (state 
component 0) and SSE state (state component 1). Table 13-1 illustrates the format of the first 416 bytes of the 
legacy region of an XSAVE area. 


Table 13-1. Format of the Legacy Region of an XSAVE Area 


FIP[63:48] or FCS or 
reserved FIP[47:32] 


FIP[31:0] 


FDP[63:48] FDS or 
or reserved FDP[47:32] 


Reserved ST0/MMO 
Reserved ST1/MM1 
Reserved ST2/MM2 
Reserved ST3/MM3 
Reserved ST4/MM4 
Reserved ST5/MM5 
Reserved ST6/MM6 
Reserved ST7/MM7 


MXCSR_MASK MXCSR FDP[31:0] 


The x87 state component comprises bytes 23:0 and bytes 159:32. The SSE state component comprises 
bytes 31:24 and bytes 415:160. The XSAVE feature set does not use bytes 511:416; bytes 463:416 are reserved. 


Section 13.7 through Section 13.9 provide details of how instructions in the XSAVE feature set use the legacy 
region of an XSAVE area. 
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13.4.2 XSAVE Header 


The XSAVE header of an XSAVE area comprises the 64 bytes starting at offset 512 from the area’s base address: 


¢ Bytes 7:0 of the XSAVE header is a state-component bitmap (see Section 13.1) called XSTATE_BV. It 
identifies the state components in the XSAVE area. 


¢ Bytes 15:8 of the XSAVE header is a state-component bitmap called XCOMP_BV. It is used as follows: 


— XCOMP_BV[63] indicates the format of the extended region of the XSAVE area (see Section 13.4.3). If it is 
clear, the standard format is used. If it is set, the compacted format is used; XCOMP_BV[62:0] provide 
format specifics as specified in Section 13.4.3. 


— XCOMP_BV[63] determines which form of the XRSTOR instruction is used. If the bit is set, the compacted 
form is used; otherwise, the standard form is used. See Section 13.8. 


— All bits in XCOMP_BV should be 0 if the processor does not support the compaction extensions to the XSAVE 
feature set. 


° Bytes 63:16 of the XSAVE header are reserved. 


Section 13.7 through Section 13.9 provide details of how instructions in the XSAVE feature set use the XSAVE 
header of an XSAVE area. 


13.4.3. Extended Region of an XSAVE Area 


The extended region of an XSAVE area starts at byte offset 576 from the area’s base address. The size of the 
extended region is determined by which state components the processor supports and which bits have been set in 
XCRO | IA32_XSS (see Section 13.3). The XSAVE feature set uses the extended area for each state component /, 
where / > 2. 


The extended region of the an XSAVE area may have one of two formats. The standard format is supported by all 
processors that support the XSAVE feature set; the compacted format is supported by those processors that 
support the compaction extensions to the XSAVE feature set (see Section 13.2). Bit 63 of the XCOMP_BV field in 
the XSAVE header (see Section 13.4.2) indicates which format is used. 


The following items describe the two possible formats of the extended region: 


¢ Standard format. Each state component i (/ => 2) is located at the byte offset from the base address of the 
XSAVE area enumerated in CPUID.(EAX=0DH,ECX=/):EBX. (CPUID.(EAX=0DH,ECX=/):EAX enumerates the 
number of bytes required for state component /. 


¢ Compacted format. Each state component / (i > 2) is located at a byte offset from the base address of the 
XSAVE area based on the XCOMP_BV field in the XSAVE header: 
— If XCOMP_BV[/] = 0, state component jis not in the XSAVE area. 


— If XCOMP_BV[/] = 1, state component / is located at a byte offset /ocation; from the base address of the 
XSAVE area, where /ocation; is determined by the following items: 


¢ If XCOMP_BV[j] = 0 for every j, 2 <j < i, location; is 576. (This item applies if / is the first bit set in 
bits 62:2 of the XCOMP_BV; it implies that state component / is located at the beginning of the 
extended region.) 


* Otherwise, let j, 2 <j <i, be the greatest value such that XCOMP_BV[j] = 1. Then /ocation, is 
determined by the following values: /ocation,; size;, as enumerated in CPUID.(EAX=0DH,ECX=j):EAX; 
and the value of align;, as enumerated in CPUID.(EAX=0DH,ECX=/):ECX[1]: 


— If align; = 0, location; = location; + size;. (This item implies that state component / is located 
immediately following the preceding state component whose bit is set in XCOMP_BV.) 


— If align; = 1, location; = ceiling(/location, + size;, 64). (This item implies that state component / is 
located on the next 64-byte boundary following the preceding state component whose bit is set in 
XCOMP_BV.) 
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13.5 XSAVE-MANAGED STATE 


The section provides details regarding how the XSAVE feature set interacts with the various XSAVE-managed state 
components. 


Unless otherwise state, the state pertaining to a particular state component is saved beginning at byte 0 of the 
section of the XSAVE are corresponding to that state component. 


13.5.1 x87 State 


Instructions in the XSAVE feature set can manage the same state of the x87 FPU execution environment (x87 
state) that can be managed using the FXSAVE and FXRSTOR instructions. They organize all x87 state as a user 
state component in the legacy region of the XSAVE area (see Section 13.4.1). This region is illustrated in 

Table 13-1; the x87 state is listed below, along with details of its interactions with the XSAVE feature set: 


° Bytes 1:0, 3:2, 7:6. These are used for the x87 FPU Control Word (FCW), the x87 FPU Status Word (FSW), and 
the x87 FPU Opcode (FOP), respectively. 


° Byte 4 is used for an abridged version of the x87 FPU Tag Word (FTW). The following items describe its usage: 


— Foreachj, 0 <j <7, XSAVE, XSAVEOPT, XSAVEC, and XSAVES save a 0 into bit j of byte 4 if x87 FPU data 
register STj has a empty tag; otherwise, XSAVE, XSAVEOPT, XSAVEC, and XSAVES save a 1 into bit j of byte 
4. 


— For each j, 0 <j <7, XRSTOR and XRSTORS establish the tag value for x87 FPU data register STj as follows. 
If bit j of byte 4 is 0, the tag for STj in the tag register for that data register is marked empty (11B); 
otherwise, the x87 FPU sets the tag for STj based on the value being loaded into that register (see below). 


¢ Bytes 15:8 are used as follows: 
— If the instruction has no REX prefix, or if REX.W = 0: 
¢ Bytes 11:8 are used for bits 31:0 of the x87 FPU Instruction Pointer Offset (FIP). 


¢ If CPUID.(EAX=07H,ECX=0H):EBX[bit 13] = 0, bytes 13:12 are used for x87 FPU Instruction Pointer 
Selector (FCS). Otherwise, XSAVE, XSAVEOPT, XSAVEC, and XSAVES save these bytes as 0000H, and 
XRSTOR and XRSTORS ignore them. 


¢ Bytes 15:14 are not used. 
— If the instruction has a REX prefix with REX.W = 1, bytes 15:8 are used for the full 64 bits of FIP. 
¢ Bytes 23:16 are used as follows: 
— If the instruction has no REX prefix, or if REX.W = 0: 
¢ Bytes 19:16 are used for bits 31:0 of the x87 FPU Data Pointer Offset (FDP). 


¢ If CPUID.(EAX=07H,ECX=0H):EBX[bit 13] = 0, bytes 21:20 are used for x87 FPU Data Pointer Selector 
(FDS). Otherwise, XSAVE, XSAVEOPT, XSAVEC, and XSAVES save these bytes as 0O00H; and XRSTOR 
and XRSTORS ignore them. 
¢ Bytes 23:22 are not used. 
— If the instruction has a REX prefix with REX.W = 1, bytes 23:16 are used for the full 64 bits of FDP. 
¢ Bytes 31:24 are used for SSE state (see Section 13.5.2). 


¢ Bytes 159:32 are used for the registers STO-ST7 (MMO-MM7). Each of the 8 register is allocated a 128-bit 
region, with the low 80 bits used for the register and the upper 48 bits unused. 


x87 state is XSAVE-managed but the x87 FPU feature is not XSAVE-enabled. The XSAVE feature set can operate on 
x87 state only if the feature set is enabled (CR4.OSXSAVE = 1).! Software can otherwise use x87 state even if the 
XSAVE feature set is not enabled. 


1. The processor ensures that XCRO[O] is always 1. 
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13.5.2 SSE State 


Instructions in the XSAVE feature set can manage the registers used by the streaming SIMD extensions (SSE 
state) just as the FXSAVE and FXRSTOR instructions do. They organize all SSE state as a user state component in 
the legacy region of the XSAVE area (see Section 13.4.1). This region is illustrated in Table 13-1; the SSE state is 
listed below, along with details of its interactions with the XSAVE feature set: 


e Bytes 23:0 are used for x87 state (see Section 13.5.1). 


¢ Bytes 27:24 are used for the MXCSR register. XRSTOR and XRSTORS generate general-protection faults (#GP) 
in response to attempts to set any of the reserved bits of the MXCSR register.! 


¢ Bytes 31:28 are used for the MKCSR_MASK value. XRSTOR and XRSTORS ignore this field. 
° Bytes 159:32 are used for x87 state. 
¢ Bytes 287:160 are used for the registers XMMO-XMM7. 


¢ Bytes 415:288 are used for the registers XMM8-XMM15. These fields are used only in 64-bit mode. Executions 
of XSAVE, XSAVEOPT, XSAVEC, and XSAVES outside 64-bit mode do not modify these bytes; executions of 
XRSTOR and XRSTORS outside 64-bit mode do not update XMM8-XMM15. See Section 13.13. 


SSE state is XSAVE-managed but the SSE feature is not XSAVE-enabled. The XSAVE feature set can operate on SSE 
state only if the feature set is enabled (CR4.OSXSAVE = 1) and has been configured to manage SSE state 
(XCRO[1] = 1). Software can otherwise use SSE state even if the XSAVE feature set is not enabled or has not been 
configured to manage SSE state. 


13.5.3. AVX State 


The register state used by the Intel® Advanced Vector Extensions (Intel AVX) comprises the MXCSR register and 
16 256-bit vector registers called YMMO-YMM15. The low 128 bits of each register YMMi is identical to the SSE 
register XMM/. Thus, the new state register state added by Intel AVX comprises the upper 128 bits of the registers 
YMMO-YMM15. These 16 128-bit values are denoted YMMO_H-YMM1i5_H and are collectively called AVX state. 


As noted in Section 13.1, the XSAVE feature set manages AVX state as user state component 2. Thus, AVX state is 
located in the extended region of the XSAVE area (see Section 13.4.3). 


As noted in Section 13.2, CPUID.(EAX=0DH,ECX=2):EBX enumerates the offset (in bytes, from the base of the 
XSAVE area) of the section of the extended region of the XSAVE area used for AVX state (when the standard format 
of the extended region is used). CPUID.(EAX=0DH,ECX=2):EAX enumerates the size (in bytes) required for AVX 
state. 


The XSAVE feature set partitions YMMO_H-YMM15_H in a manner similar to that used for the XMM registers (see 
Section 13.5.2). Bytes 127:0 of the AVX-state section are used for YMMO_H-YMM7_H. Bytes 255:128 are used for 
YMM8_H-YMM15_H, but they are used only in 64-bit mode. Executions of XSAVE, XSAVEOPT, XSAVEC, and 
XSAVES outside 64-bit mode do not modify bytes 255:128; executions of XRSTOR and XRSTORS outside 64-bit 
mode do not update YMM8_H-YMM15_H. See Section 13.13. In general, bytes 16/+15:16/ are used for YMMi_H 
(forO0 </<15). 


AVX state is XSAVE-managed and the Intel AVX feature is XSAVE-enabled. The XSAVE feature set can operate on 
AVX state only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to manage AVX state 
(XCRO[2] = 1). Intel AVX instructions cannot be used unless the XSAVE feature set is enabled and has been config- 
ured to manage AVX state. 


13.5.4 MPX State 


The register state used by the Intel® Memory Protection Extensions (MPX) comprises the 4 128-bit bounds regis- 
ters BNDO-BND3 (BNDREGS state); and the 64-bit user-mode configuration register BNDCFGU and the 64-bit 
MPX status register BNDSTATUS (collectively, BNDCSR state). Together, these two user state components 
compose MPxX state. 


1. While MXCSR and MXCSR_MASK are part of SSE state, their treatment by the XSAVE feature set is not the same as that of the XMM 
registers. See Section 13.7 through Section 13.11 for details. 
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As noted in Section 13.1, the XSAVE feature set manages MPX state as state components 3-4. Thus, MPX state is 
located in the extended region of the XSAVE area (see Section 13.4.3). The following items detail how these state 
components are organized in this region: 


¢ BNDREGS state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=3):EBX enumerates the offset (in bytes, from the base of the 
XSAVE area) of the section of the extended region of the XSAVE area used for BNDREGS state (when the 
standard format of the extended region is used). CPUID.(EAX=0DH,ECX=3):EAX enumerates the size (in 
bytes) required for BNDREGS state. The BNDREGS section is used for the 4 128-bit bound registers BNDO- 
BND3, with bytes 16/+15:16/ being used for BNDi. 


° BNDCSR state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=4):EBX enumerates the offset of the section of the extended 
region of the XSAVE area used for BNDCSR state (when the standard format of the extended region is used). 
CPUID.(EAX=0DH,ECX=4):EAX enumerates the size (in bytes) required for BNDCSR state. In the BNDSCR 
section, bytes 7:0 are used for BNDCFGU and bytes 15:8 are used for BNDSTATUS. 


Both components of MPX state are XSAVE-managed and the Intel MPX feature is XSAVE-enabled. The XSAVE 
feature set can operate on MPX state only if the feature set is enabled (CR4.OSXSAVE = 1) and has been configured 
to manage MPX state (XCRO[4:3] = 11b). Intel MPX instructions cannot be used unless the XSAVE feature set is 
enabled and has been configured to manage MPxX state. 


13.5.5  AVX-512 State 


The register state used by the Intel® Advanced Vector Extensions 512 (Intel AVX-512) comprises the MXCSR 
register, the 8 64-bit opmask registers kO-k7, and 32 512-bit vector registers called ZMMO-ZMM31. For each i, 0 < 
i < 15, the low 256 bits of register ZMMi is identical to the Intel AVX register YMM/. Thus, the new state register 
state added by Intel AVX-512 comprises the following user state components: 


¢ The opmask registers, collectively called opmask state. 


¢ The upper 256 bits of the registers ZMMO-ZMM15. These 16 256-bit values are denoted ZMMO_H-ZMM15_H 
and are collectively called ZMM_Hi256 state. 


° The 16 512-bit registers ZMM16-ZMM31, collectively called Hil16_ZMM state. 
Together, these three state components compose AVX-512 state. 


As noted in Section 13.1, the XSAVE feature set manages AVX-512 state as state components 5-7. Thus, AVX-512 
state is located in the extended region of the XSAVE area (see Section 13.4.3). The following items detail how these 
state components are organized in this region: 


° Opmask state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=5):EBX enumerates the offset (in bytes, from the base of the 
XSAVE area) of the section of the extended region of the XSAVE area used for opmask state (when the standard 
format of the extended region is used). CPUID.(EAX=0DH,ECX=5):EAX enumerates the size (in bytes) required 
for opmask state. The opmask section is used for the 8 64-bit opmask registers kO-k7, with bytes 8/+7:8/ 
being used for ki. 


° ZMM_Hi256 state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=6):EBX enumerates the offset of the section of the extended 
region of the XSAVE area used for ZMM_Hi256 state (when the standard format of the extended region is 
used). CPUID.(EAX=0DH,ECX=6):EAX enumerates the size (in bytes) required for ZMM_Hi256 state. 


The XSAVE feature set partitions ZMMO_H-ZMM1i5_H in a manner similar to that used for the XMM registers 
(see Section 13.5.2). Bytes 255:0 of the ZMM_Hi256-state section are used for ZMMO_H-ZMM7_H. 

Bytes 511:256 are used for ZMM8_H-ZMM15_H, but they are used only in 64-bit mode. Executions of XSAVE, 
XSAVEOPT, XSAVEC, and XSAVES outside 64-bit mode do not modify bytes 511:256; executions of XRSTOR 
and XRSTORS outside 64-bit mode do not update ZMM8_H-ZMM15_H. See Section 13.13. In general, 

bytes 32/+31:32/ are used for ZMMi_H (for 0 <i< 15). 


¢ Hi16_ZMM state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=7):EBX enumerates the offset of the section of the extended 
region of the XSAVE area used for Hi16_ZMM state (when the standard format of the extended region is used). 
CPUID.(EAX=0DH,ECX=7):EAX enumerates the size (in bytes) required for Hi16_ZMM state. 
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The XSAVE feature set accesses Hi16_ZMM state only in 64-bit mode. Executions of XSAVE, XSAVEOPT, 
XSAVEC, and XSAVES outside 64-bit mode do not modify the Hil16_ZMM section; executions of XRSTOR and 
XRSTORS outside 64-bit mode do not update ZMM16-ZMM31. See Section 13.13. In general, 

bytes 64(ij-16)+63:64(/-16) are used for ZMMi (for 16 <i < 31). 


All three components of AVX-512 state are XSAVE-managed and the Intel AVX-512 feature is XSAVE-enabled. The 
XSAVE feature set can operate on AVX-512 state only if the feature set is enabled (CR4.OSXSAVE = 1) and has 
been configured to manage AVX-512 state (XCRO[7:5] = 111b). Intel AVX-512 instructions cannot be used unless 
the XSAVE feature set is enabled and has been configured to manage AVX-512 state. 


13.5.6 PT State 


The register state used by Intel Processor Trace (PT state) comprises the following 9 MSRs: IA32_RTIT_CTL, 
IA32_RTIT_OUTPUT_BASE, IA32_RTIT_OUTPUT_MASK_PTRS, IA32_RTIT_STATUS, IA32_RTIT_CR3_MATCH, 
IA32_RTIT_ADDRO_A, IA32_RTIT_ADDRO_B, IA32_RTIT_ADDR1_A, and IA32_RTIT_ADDR1_B.! 


As noted in Section 13.1, the XSAVE feature set manages PT state as supervisor state component 8. Thus, PT state 
is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=8):EAX enumerates the size (in bytes) required for PT state. The MSRs are each allocated 
8 bytes in the state component in the order given above. Thus, IA32_RTIT_CTL is at byte offset 0, 
IA32_RTIT_OUTPUT_BASE at byte offset 8, etc. Any locations in the state component at or beyond byte offset 72 
are reserved. 


PT state is XSAVE-managed but Intel Processor Trace is not XSAVE-enabled. The XSAVE feature set can operate on 
PT state only if the feature set is enabled (CR4.OSXSAVE = 1) and has been configured to manage PT state 
(IA32_XSS[8] = 1). Software can otherwise use Intel Processor Trace and access its MSRs (using RDMSR and 
WRMSR) even if the XSAVE feature set is not enabled or has not been configured to manage PT state. 


The following items describe special treatment of PT state by the XSAVES and XRSTORS instructions: 


¢ If XSAVES saves PT state, the instruction clears IA32_RTIT_CTL.TraceEn (bit 0) after saving the value of the 
IA32_RTIT_CTL MSR and before saving any other PT state. If XSAVES causes a fault or a VM exit, it restores 
IA32_RTIT_CTL.TraceEn to its original value. 


¢ If XSAVES saves PT state, the instruction saves zeroes in the reserved portions of the state component. 


¢ If XRSTORS would restore (or initialize) PT state and IA32_RTIT_CTL.TraceEn = 1, the instruction causes a 
general-protection exception (#GP) before modifying PT state. 


¢ If XRSTORS causes an exception or a VM exit, it does so before any modification to IA32_RTIT_CTL.TraceEn 
(even if it has loaded other PT state). 


13.5.7. PKRU State 


The register state used by the protection-key feature (PKRU state) is the 32-bit PKRU register. As noted in Section 
13.1, the XSAVE feature set manages PKRU state as user state component 9. Thus, PKRU state is located in the 
extended region of the XSAVE area (see Section 13.4.3). 


As noted in Section 13.2, CPUID.(EAX=0DH,ECX=9):EBX enumerates the offset (in bytes, from the base of the 
XSAVE area) of the section of the extended region of the XSAVE area used for PKRU state (when the standard 
format of the extended region is used). CPUID.(EAX=0DH,ECX=9):EAX enumerates the size (in bytes) required for 
PKRU state. The XSAVE feature set uses bytes 3:0 of the PK-state section for the PKRU register. 


PKRU state is XSAVE-managed but the protection-key feature is not XSAVE-enabled. The XSAVE feature set can 
operate on PKRU state only if the feature set is enabled (CR4.O0SXSAVE = 1) and has been configured to manage 
PKRU state (XCRO[9] = 1). Software can otherwise use protection keys and access PKRU state even if the XSAVE 
feature set is not enabled or has not been configured to manage PKRU state. 


1. These MSRs might not be supported by every processor that supports Intel Processor Trace. Software can use the CPUID instruction 
to discover which are supported; see Section 33.3.1, “Detection of Intel Processor Trace and Capability Enumeration,” of Intel® 64 
and IA-32 Architectures Software Developer's Manual, Volume 3C. 
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The value of the PKRU register determines the access rights for user-mode linear addresses. (See Section 4.6, 
“Access Rights,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.) The access rights 
that pertain to an execution of the XRSTOR and XRSTORS instructions are determined by the value of the register 
before the execution and not by any value that the execution might load into the PKRU register. 


13.5.8 PASID State 


The register state used by the ENQCMD instruction and process address space identifiers (PASID state) comprises 
the IA32_PASID MSR. 


As noted in Section 13.1, the XSAVE feature set manages PASID state as supervisor state component 10. Thus, 
PASID state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=10):EAX enumerates the size (in bytes) required for PASID state. The IA32_PASID MSR is 
allocated 8 bytes at byte offset 0 in the state component. 


PASID state is XSAVE-managed but the ENQCMD instruction and process address space identifiers are not XSAVE- 
enabled. The XSAVE feature set can operate on PASID state only if the feature set is enabled (CR4.0SXSAVE = 1) 
and has been configured to manage PASID state (IA32_XSS[10] = 1). Software can otherwise use the ENQCMD 
instruction and process address space identifiers, and access the IA32_PASID MSR (using RDMSR and WRMSR) 
even if the XSAVE feature set is not enabled or has not been configured to manage PASID state. 


13.5.9 CET State 


The register state used by Control-Flow Enforcement Technology (CET) comprises the two 64-bit MSRs 
(IA32_U_CET and IA32_PL3_SSP) that manage CET when CPL = 3 (CET_U state); and the three 64-bit MSRs 
(IA32_PLO_SSP-IA32_PL2_SSP) that manage CET when CPL < 3 (CET_S state). Together, these two supervisor 
state components compose CET state. 


As noted in Section 13.1, the XSAVE feature set manages CET state as supervisor state components 11-12. Thus, 
CET state is located in the extended region of the XSAVE area (see Section 13.4.3). The following items detail how 
these state components are organized in this region: 


° CET_U state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=11):EAX enumerates the size (in bytes) required for CET_U 
state. The CET_U section is used for the 64-bit MSRs IA32_U_CET and IA32_PL3_SSP, with bytes 7:0 being 
used for IA32_U_CET and bytes 15:8 being used for IA32_PL3_SSP. 


° CET_S state. 
As noted in Section 13.2, CPUID.(EAX=0DH,ECX=12):EAX enumerates the size (in bytes) required for CET_S 
state. The CET_S section is used for the three 64-bit MSRs IA32_PLO_SSP-IA32_PL2_SSP, with bytes 8/+7:8/ 
being used for IA32_PLi_SSP. 


The two components of CET state are XSAVE-managed and CET is not XSAVE-enabled. The XSAVE feature set can 
operate on CET_U state (respectively, CET_S state) only if the feature set is enabled (CR4.OSXSAVE = 1) and has 
been configured to manage CET_U state (respectively, CET_S state) by setting IA32_XSS[11] (respectively, 
IA32_XSS[12]). Software can otherwise use CET and access the CET MSRs (using RDMSR and WRMSR) even if the 
XSAVE feature set is not enabled or has not been configured to manage CET state. 


13.5.10 HDC State 
The register state used by hardware duty cycling (HDC state) comprises the IA32_PM_CTL1 MSR. 


As noted in Section 13.1, the XSAVE feature set manages HDC state as supervisor state component 13. Thus, HDC 
state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=13):EAX enumerates the size (in bytes) required for HDC state. The IA32_PM_CTL1 MSR 
is allocated 8 bytes at byte offset 0 in the state component. 


1. The lA32_S_CET and 1A32_INTERRUPT_SSP_TABLE_ADDR MSRs also control CET when CPL < 3. However, they are not managed by 
the XSAVE feature set and are thus not considered in this chapter. 
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HDC state is XSAVE-managed but hardware duty cycling is not XSAVE-enabled. The XSAVE feature set can operate 
on HDC state only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to manage HDC state 
(IA32_XSS[13] = 1). Software can otherwise use hardware duty cycling and access the IA32_PM_CTL1 MSR (using 
RDMSR and WRMSR) even if the XSAVE feature set is not enabled or has not been configured to manage HDC state. 


13.5.11 UINTR State 

The register state used by user interrupts (UINTR state) comprises 48 bytes in memory with the following layout: 

° Bytes 7:0 are for the IA32_UINTR_HANDLER MSR. 

¢ Bytes 15:8 are for the IA32_UINTR_STACKADJUST MSR. 

¢ Bytes 23:16 are for the IA32_UINTR_MISC MSR with exception of the last bit (bit 7 of byte 23), which is used 
for UIF. (Because UIF is not part of the IA32_UINTR_MISC MSR, software that reads a value from bytes 23:16 
should clear bit 63 of that 64-bit value before attempting to write it to the IA32_UINTR_MISC MSR.). 

e =6Bytes 31:24 are for the IA32_UINTR_PD MSR. 

° =6Bytes 39:32 are for the IA32_UINTR_RR MSR. 

e Bytes 47:40 are for the IA32_UINTR_TT MSR. 


As noted in Section 13.1, the XSAVE feature set manages UINTR state as supervisor state component 14. Thus, 
UINTR state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=14):EAX enumerates the size (in bytes) required for UINTR state. 


UINTR state is XSAVE-managed but user interrupts are not XSAVE-enabled. The XSAVE feature set can operate on 
UINTR state only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to manage UINTR state 
(IA32_XSS[14] = 1). Software can otherwise use user interrupts and access the MSRs (using RDMSR and WRMSR) 
even if the XSAVE feature set is not enabled or has not been configured to manage UINTR state. 


The management of the UINTR state component by XSAVES follows the architecture of the XSAVE feature set. The 
following items identify points that are specific to saving the UINTR state component: 


¢ XSAVES writes the user-interrupt registers to the user-interrupt state component using the format specified 
above. 


¢ XSAVES stores zeros to bits and bytes identified above as reserved. 


° The values saved for the IA32_UINTR_HANDLER, IA32_UINTR_STACKADJUST, IA32_UINTR_PD, and 
IA32_UINTR_TT MSRs are always canonical relative to the maximum linear-address width enumerated by 
CPUID}. 


e  =©After saving the user-interrupt state component, XSAVES clears UINV. (UINV is IA32_UINTR_MISC[39:32]; 
XSAVES does not modify the remainder of that MSR.) 


The management of the user-interrupt state component by XRSTORS follows the architecture of the XSAVE feature 
set. The following items identify points that are specific to restoring the user-interrupt state component: 


¢ Before restoring the user-interrupt state component, XRSTORS verifies that UINV is 0. If it is not, XRSTORS 
causes a general-protection fault (#GP) before loading any part of the user-interrupt state component. (UINV 
is IA32_UINTR_MISC[39:32]; XRSTORS does not check the contents of the remainder of that MSR.) 


¢ If the instruction mask and XSAVE area used by XRSTORS indicates that the user-interrupt state component 
should be loaded from the XSAVE area, XRSTORS reads the user-interrupt registers from the XSAVE area using 
the format identified above. The values read cause a general-protection fault (#GP) in any of the following 
cases: 


— If the value to be loaded into any one of the IA32_UINTR_HANDLER, IA32_UINTR_STACKADJUST, 
IA32_UINTR_PD, or IA32_UINTR_TT MSRs is not canonical relative to the maximum linear-address width 
enumerated by CPUID. 


— Ifthe value to be loaded into the IA32_UINTR_MISC MSR sets any of bits 62:40. These bits are reserved in 
the MSR. (Bit 63 is also reserved in the MSR, but the XSAVE feature set uses bit 63 of this value for UIF.) 


1. They might not be canonical relative to the current paging mode if it supports only smaller linear addresses. 
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— Ifthe value to be loaded into the IA32_UINTR_ PD MSR sets any of bits 5:0. These bits are reserved in the 
MSR. 


— Ifthe value to be loaded into the IA32_UINTR_ TT MSR sets any of bits 3:1. These bits are reserved in the 
MSR. 


¢ If XRSTORS causes a fault or a VM exit after loading any part of the user-interrupt state component, XRSTORS 
clears UINV before delivering the fault or VM exit. (Other elements of user-interrupt state, including other parts 
of the IA32_UINTR_MISC MSR, may retain the values that were loaded by XRSTORS.) 


e =©After an execution of XRSTORS that loads the user-interrupt state component, the logical processor recognizes 
a pending user interrupt if and only if some bit is set in the IA32_UINTR_RR MSR (see Section 7.4.1 in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). 


13.5.12 LBR State 


The register state used by last-branch records (LBR state) comprises 101 MSRs organized as follows: 
IA32_LBR_CTL; IA32_LBR_DEPTH; IA32_LER_FROM_IP; IA32_LER_TO_IP; IA32_LER_INFO; and 32 triples of 
MSRs, IA32_LBR_i_FROM_IP, IA32_LBR_/_TO_IP, IA32_LBR_/_INFO, for each value of /,0 <i < 31. 


As noted in Section 13.1, the XSAVE feature set manages LBR state as supervisor state component 15. Thus, LBR 
state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=15):EAX enumerates the size (in bytes) required for LBR state. The IA32_LBR_CTL MSR is 
allocated 8 bytes at byte offset 0 in the state component. The remaining MSRs are each allocated 8 bytes in the 
state component in the order given above. Thus, IA32_LBR_DEPTH is at byte offset 8, ..., IA32_LBR_O_FROM_IP 
at byte offset 40, IA32_LBR_O_TO_IP at byte offset 48, IA32_LBR_O_INFO at byte offset 56, 
IA32_LBR_1_FROM_IP at byte offset 64, ..., and IA32_LBR_31_INFO at byte offset 800. Any locations in the state 
component at or beyond byte offset 808 are reserved. 


LBR state is XSAVE-managed but LBRs are not XSAVE-enabled. The XSAVE feature set can operate on LBR state 
only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to manage LBR state 
(IA32_XSS[15] = 1). Software can otherwise use LBRs and access the MSRs (using RDMSR and WRMSR) even if 
the XSAVE feature set is not enabled or has not been configured to manage LBR state. 


The following items describe special treatment of LBR state by the XSAVES and XRSTORS instructions: 


¢ If XSAVES would save LBR state and that state is not in its initial configuration (see Section 13.6), the 
instruction always saves IA32_LBR_CTL, IA32_LBR_DEPTH, IA32_LER_FROM_IP, IA32_LER_TO_IP, and 
IA32_LER_INFO. It saves the triples IA32_LBR_/_FROM_IP, IA32_LBR_/_TO_IP, IA32_LBR_j/_INFO, for each 
value of i, O < i < D, where D is the value of IA32_LBR_DEPTH. It will not save the values of the remaining 
triples, although it may access the corresponding fields in the XSAVE area. 


¢ If XSAVES would save LBR state and that state is in its initial configuration, the instruction does not save any 
LBR state and will not access that component of the XSAVE area. 


° If XRSTORS would initialize LBR state, IA32_LBR_DEPTH is not modified and zero is written to the other MSRs 
that compose LBR state. 


¢ If XRSTORS would restore LBR state, behavior depends on the current value of IA32_LBR_DEPTH and the value 
of corresponding field in the XSAVE area: 


— If the current value of IA32_LBR_DEPTH equals the value of corresponding field in the XSAVE area, the 
instruction restores IA32_LBR_CTL, IA32_LER_FROM_IP, IA32_LER_TO_IP, IA32_LER_INFO, and the 
triples IA32_LBR_/_FROM_IP, IA32_LBR_/_TO_IP, IA32_LBR_/j_INFO, for each value of /, 0 < i < D, where 
D is the value of IA32_LBR_DEPTH. It will not restore the values of the remaining triples, although it may 
access the corresponding fields in the XSAVE area. 


— Ifthe IA32_LBR_DEPTH field in the XSAVE area sets any reserved bits, the instruction causes a general- 
protection exception (#GP). 


— If neither of the previous items apply, the instruction restores IA32_LBR_CTL, IA32_LER_FROML_IP, 
IA32_LER_TO_IP, and IA32_LER_INFO, but it writes zero to the triples IA32_LBR_i/_FROM_ IP, 
IA32_LBR_i_TO_IP, IA32_LBR_/_INFO, for each value of ij, O < i < 31. Such an execution does not modify 
XINUSE[15] (see Section 13.6 and Section 13.12). 


13-16 Vol. 1 


MANAGING STATE USING THE XSAVE FEATURE SET 


13.5.13 HWP State 
The register state used by hardware P-states (HWP state) comprises the IA32_HWP_REQUEST MSR. 


As noted in Section 13.1, the XSAVE feature set manages HWP state as supervisor state component 16. Thus, HWP 
state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 13.2, 
CPUID.(EAX=0DH,ECX=16):EAX enumerates the size (in bytes) required for HWP state. The IA32_HWP_REQUEST 
MSR is allocated 8 bytes at byte offset 0 in the state component. 


HWP state is XSAVE-managed but the hardware P-states feature is not XSAVE-enabled. The XSAVE feature set can 
operate on HWP state only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to manage 
HWP state (IA32_XSS[16] = 1). Software can otherwise use hardware P-states and access the 
IA32_HWP_REQUEST MSR (using RDMSR and WRMSR) even if the XSAVE feature set is not enabled or has not 
been configured to manage HWP state. 


13.5.14 AMX State 


The register state used by the Intel® Advanced Matrix Extensions (Intel AMX) comprises two state components, 
TILECFG and TILEDATA. Together, these two state components compose AMX state. 


As noted in Section 13.1, the XSAVE feature set manages AMX state as state components 17-18. Thus, AMX state 
is located in the extended region of the XSAVE area (see Section 13.4.3). The following items detail how these 
state components are organized in this region: 


° TILECFG state. 
As noted in Section 13.1, the XSAVE feature set manages TILECFG state as user state component 17. Thus, 
TILECFG state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 
13.2, CPUID.(EAX=0DH,ECX=17):EAX enumerates the size (in bytes) required for TILECFG state. 


° TILEDATA state. 
As noted in Section 13.1, the XSAVE feature set manages TILEDATA state as user state component 18. Thus, 
TILEDATA state is located in the extended region of the XSAVE area (see Section 13.4.3). As noted in Section 
13.2, CPUID.(EAX=0DH,ECX=18):EAX enumerates the size (in bytes) required for TILEDATA state. 


Both components of AMX state are XSAVE-managed, and the AMX feature is XSAVE-enabled. The XSAVE feature 
set can operate on AMxX state only if the feature set is enabled (CR4.0SXSAVE = 1) and has been configured to 
manage AMxX state (XCRO[18:17] = 11b). Intel AMX instructions cannot be used unless the XSAVE feature set is 
enabled and has been configured to manage AMxX state. 


The following items describe special treatment of TILECFG and TILEDATA by the XSAVE feature set: 
¢ Loading of TILECFG and TILEDATA by XRSTOR and XRSTORS: 
— While the LDTILECFG instruction generates a general-protection fault (#GP) if it would load the TILECFG 


register with an unsupported value executions of XRSTOR and XRSTORS do not do so. Instead, they 
initialize the register (resulting in TILES CONFIGURED = 0). 


While executions of LDTILECFG initialize TILEDATA, executions of XRSTOR and XRSTORS do not modify 
TILEDATA unless loading it from memory. 

While the value of the TILECFG register can limit how Intel AMX instructions access TILEDATA, such 
limitations do not apply to XRSTOR and XRSTORS. An execution of either of those instructions loads all 8 
KBytes of TILEDATA regardless of the value in the TILECFG register (or the value that the instruction may 
be loading into that register). 


¢ Saving of TILEDATA by XSAVE, XSAVEC, XSAVEOPT, and XSAVES: 


— While the value of the TILECFG register can limit how Intel AMX instructions access TILEDATA, such 
limitations do not apply to XSAVE, XSAVEC, XSAVEOPT, and XSAVES. An execution of any of those instruc- 
tions saves all 8 KBytes of TILEDATA regardless of the value in the TILECFG register. 
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13.6 PROCESSOR TRACKING OF XSAVE-MANAGED STATE 


The XSAVEOPT, XSAVEC, and XSAVES instructions use two optimizations to reduce the amount of data that they 
write to memory. They avoid writing data for any state component known to be in its initial configuration (the init 
optimization). In addition, if either XSAVEOPT or XSAVES is using the same XSAVE area as that used by the most 
recent execution of XRSTOR or XRSTORS, it may avoid writing data for any state component whose configuration 
is known not to have been modified since then (the modified optimization). (XSAVE does not use these optimi- 
zations, and XSAVEC does not use the modified optimization.) The operation of XSAVEOPT, XSAVEC, and XSAVES 
are described in more detail in Section 13.9 through Section 13.11. 


A processor can support the init and modified optimizations with special hardware that tracks the state components 
that might benefit from those optimizations. Other implementations might not include such hardware; such a 
processor would always consider each such state component as not in its initial configuration and as modified since 
the last execution of XRSTOR or XRSTORS. 


The following notation describes the state of the init and modified optimizations: 


¢ XINUSE denotes the state-component bitmap corresponding to the init optimization. If XINUSE[/] = 0, state 
component / is known to be in its initial configuration; otherwise XINUSE[/] = 1. It is possible for XINUSE[/] to 
be 1 even when state component / is in its initial configuration. On a processor that does not support the init 
optimization, XINUSE[/] is always 1 for every value of i. 


Executing XGETBV with ECX = 1 returns in EDX:EAX the logical-AND of XCRO and the current value of the 
XINUSE state-component bitmap. Such an execution of XGETBV always sets EAX[1] to 1 if XCRO[1] = 1 and 
MXCSR does not have its RESET value of 1F80H. Section 13.2 explains how software can determine whether a 
processor supports this use of XGETBV. 


¢ XMODIFIED denotes the state-component bitmap corresponding to the modified optimization. If 
XMODIFIED[/] = 0, state component / is known not to have been modified since the most recent execution of 
XRSTOR or XRSTORS; otherwise XMODIFIED[/] = 1. It is possible for XMODIFIED[/] to be 1 even when state 
component / has not been modified since the most recent execution of XRSTOR or XRSTORS. On a processor 
that does not support the modified optimization, XMODIFIED[/] is always 1 for every value of i. 


A processor that implements the modified optimization saves information about the most recent execution of 
XRSTOR or XRSTORS in a quantity called XRSTOR_INFO, a 4-tuple containing the following: (1) the CPL; 

(2) whether the logical processor was in VMX non-root operation; (3) the linear address of the XSAVE area; and 
(4) the XCOMP_BV field in the XSAVE area. An execution of XSAVEOPT or XSAVES uses the modified optimization 
only if that execution corresponds to XRSTOR_INFO on these four parameters. 


This mechanism implies that, depending on details of the operating system, the processor might determine that an 


execution of XSAVEOPT by one user application corresponds to an earlier execution of XRSTOR by a different appli- 
cation. For this reason, Intel recommends the application software not use the XSAVEOPT instruction. 


The following items specify the initial configuration each state component (for the purposes of defining the XINUSE 

bitmap): 

° x87 state. x87 state is in its initial configuration if the following all hold: FCW is 037FH; FSW is OOOOH; FTW is 
FFFFH; FCS and FDS are each OOOOH; FIP and FDP are each 00000000_0O0000000H; each of STO-ST7 is 
0000_00000000_00000000H. 

° SSE state. In 64-bit mode, SSE state is in its initial configuration if each of XMMO-XMM15 is 0. Outside 64-bit 
mode, SSE state is in its initial configuration if each of XMMO-XMM7 is 0. XINUSE[1] pertains only to the state 
of the XMM registers and not to MXCSR. An execution of XRSTOR or XRSTORS outside 64-bit mode does not 
update XMM8-XMM15. (See Section 13.13.) 

° AVX state. In 64-bit mode, AVX state is in its initial configuration if each of YMMO_H-YMM15_H is 0. Outside 
64-bit mode, AVX state is in its initial configuration if each of YMMO_H-YMM7_H is 0. An execution of XRSTOR 
or XRSTORS outside 64-bit mode does not update YMM8_H-YMM15_H. (See Section 13.13.) 

¢ BNDREGS state. BNDREGS state is in its initial configuration if the value of each of BNDO-BND3 is 0. 

¢ BNDCSR state. BNDCSR state is in its initial configuration if BNDCFGU and BNDCSR each has value 0. 

* Opmask state. Opmask state is in its initial configuration if each of the opmask registers kO-k7 is 0. 


° ZMM_Hi256 state. In 64-bit mode, ZMM_Hi256 state is in its initial configuration if each of ZMMO_H- 
ZMM15_His 0. Outside 64-bit mode, ZMM_Hi256 state is in its initial configuration if each of ZMMO_H-ZMM7_H 
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is 0. An execution of XRSTOR or XRSTORS outside 64-bit mode does not update ZMM8_H-ZMM15_H. (See 
Section 13.13.) 


° Hi16_ZMM state. In 64-bit mode, Hi16_ZMM state is in its initial configuration if each of ZMM16-—ZMM31 is 0. 
Outside 64-bit mode, Hi16_ZMM state is always in its initial configuration. An execution of XRSTOR or XRSTORS 
outside 64-bit mode does not update ZMM31-ZMM31. (See Section 13.13.) 


¢ PT state. PT state is in its initial configuration if each of the 9 MSRs is 0. 

¢ PKRU state. PKRU state is in its initial configuration if the value of the PKRU is 0. 

° PASID state. PASID state is in its initial configuration if the value of the IA32_PASID MSR is 0. 

¢ CET_U state. CET_U state is in its initial configuration if both of the MSRs are 0. 

° CET_S state. CET_S state is in its initial configuration if each of the three MSRs is 0. 

° HDC state. HDC state is in its initial configuration if the value of the IA32_PM_CTL1 MSR is 1. 

¢ UINTR state. UINTR state is in its initial configuration if all user-interrupt registers (including UIF) are zero. 


¢ LBR state. LBR state is in its initial configuration if the value of each of the MSRs is 0, with the exception of 
IA32_LBR_DEPTH. XINUSE[15] does not pertain to IA32_LBR_DEPTH. 


° HWP state. HWP state is in its initial configuration if the value of the IA32_HWP_REQUEST MSR is 8000FFO1H. 
° AMX state. AMX state is in its initial configuration if the TILECFG register is zero and all tile data are zero. 


13.7. OPERATION OF XSAVE 


The XSAVE instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. The logical-AND of XCRO and the instruction mask is the requested-feature bitmap (RFBM) of the user 
state components to be saved. 


The following conditions cause execution of the XSAVE instruction to generate a fault: 
¢ If the XSAVE feature set is not enabled (CR4.0SXSAVE = 0), an invalid-opcode exception (#UD) occurs. 
° If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 

e If the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) occurs. 


If none of these conditions cause a fault, execution of XSAVE reads the XSTATE_BV field of the XSAVE header (see 
Section 13.4.2) and writes it back to memory, setting XSTATE_BV[/] (0 </ < 63) as follows: 

¢ = If RFBM[/] = 0, XSTATE_BV[/] is not changed. 

° If RFBM[/] = 1, XSTATE_BV[/] is set to the value of XINUSE[/]. Section 13.6 defines XINUSE to describe the 


processor init optimization and specifies the initial configuration of each state component. The nature of that 
optimization implies the following: 


1 


— If state component / is in its initial configuration, XINUSE[/] may be either 0 or 1, and XSTATE_BV[/] may 
be written with either 0 or 1. 


XINUSE[1] pertains only to the state of the XMM registers and not to MXCSR. Thus, XSTATE_BV[1] may be 
written with 0 even if MXCSR does not have its RESET value of 1F80H. 


— If state component / is not in its initial configuration, XINUSE[/] = 1 and XSTATE_BV[/] is written with 1. 


(As explained in Section 13.6, the initial configurations of some state components may depend on whether the 
processor is in 64-bit mode.) 


The XSAVE instruction does not write any part of the XSAVE header other than the XSTATE_BV field; in particular, 
it does not write to the XCOMP_BV field. 


Execution of XSAVE saves into the XSAVE area those state components corresponding to bits that are set in RFBM. 
State components 0 and 1 are located in the legacy region of the XSAVE area (see Section 13.4.1). Each state 
component /, 2 <i < 62, is located in the extended region; the XSAVE instruction always uses the standard format 
for the extended region (see Section 13.4.3). 


1. If CRO.AM = 1, CPL = 3, and EFLAGS.AC =1, an alignment-check exception (HAC) may occur instead of #GP. 
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The MXCSR register and MKCSR_MASK are part of SSE state (see Section 13.5.2) and are thus associated with 
RFBM[1]. However, the XSAVE instruction also saves these values when RFBM[2] = 1 (even if RFBM[1] = 0). 


See Section 13.5 for specifics for each state component and for details regarding mode-specific operation and 
operation determined by instruction prefixes. See Section 13.13 for details regarding faults caused by memory 
accesses. 


13.8 OPERATION OF XRSTOR 


The XRSTOR instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. The logical-AND of XCRO and the instruction mask is the requested-feature bitmap (RFBM) of the user 
state components to be restored. 


The following conditions cause execution of the XRSTOR instruction to generate a fault: 
e If the XSAVE feature set is not enabled (CR4.OSXSAVE = 0), an invalid-opcode exception (#UD) occurs. 
e =6If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 

e If the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) occurs. 


After checking for these faults, the XRSTOR instruction reads the XCOMP_BV field in the XSAVE area’s XSAVE 
header (see Section 13.4.2). If XCOMP_BV[63] = 0, the standard form of XRSTOR is executed (see Section 
13.8.1); otherwise, the compacted form of XRSTOR is executed (see Section 13.8.2). 


See Section 13.2 for details of how to determine whether the compacted form of XRSTOR is supported. 


1 


13.8.1 Standard Form of XRSTOR 

The standard from of XRSTOR performs additional fault checking. Either of the following conditions causes a 
general-protection exception (#GP): 

° The XSTATE_BV field of the XSAVE header sets a bit that is not set in XCRO. 

* Bytes 23:8 of the XSAVE header are not all 0 (this implies that all bits in XCOMP_BV are 0).? 

If none of these conditions cause a fault, the processor updates each state component / for which RFBM[/] = 1. 
XRSTOR updates state component j based on the value of bit / in the XSTATE_BV field of the XSAVE header: 


e If XSTATE_BV[/] = 0, the state component is set to its initial configuration. Section 13.6 specifies the initial 
configuration of each state component. 


The initial configuration of state component 1 pertains only to the XMM registers and not to MXCSR. See below 
for the treatment of MXCSR 


e If XSTATE_BV[/] = 1, the state component is loaded with data from the XSAVE area. See Section 13.5 for 
specifics for each state component and for details regarding mode-specific operation and operation determined 
by instruction prefixes. See Section 13.13 for details regarding faults caused by memory accesses. 


State components 0 and 1 are located in the legacy region of the XSAVE area (see Section 13.4.1). Each state 
component /, 2 <i < 62, is located in the extended region; the standard form of XRSTOR uses the standard 
format for the extended region (see Section 13.4.3). 


The MXCSR register is part of state component 1, SSE state (see Section 13.5.2). However, the standard form of 
XRSTOR loads the MXCSR register from memory whenever the RFBM[1] (SSE) or RFBM[2] (AVX) is set, regardless 


1. If CRO.AM = 1, CPL = 3, and EFLAGS.AC =1, an alignment-check exception (HAC) may occur instead of #GP. 


2. If the processor does not support the compacted form of XRSTOR, it may execute the standard form of XRSTOR without first read- 
ing the XCOMP_BV field. A processor supports the compacted form of XRSTOR only if it enumerates 
CPUID.(EAX=O0DH,ECX=1):EAX[1] as 1. 

3. Bytes 63:24 of the XSAVE header are also reserved. Software should ensure that bytes 63:16 of the XSAVE header are all O in any 
XSAVE area. (Bytes 15:8 should also be 0 if the XSAVE area is to be used on a processor that does not support the compaction 
extensions to the XSAVE feature set.) 
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of the values of XSTATE_BV[1] and XSTATE_BV[2]. The standard form of XRSTOR causes a general-protection 
exception (#GP) if it would load MXCSR with an illegal value. 


13.8.2 |Compacted Form of XRSTOR 


The compacted from of XRSTOR performs additional fault checking. Any of the following conditions causes a #GP: 
¢ The XCOMP_BV field of the XSAVE header sets a bit in the range 62:0 that is not set in XCRO. 

¢ The XSTATE_BV field of the XSAVE header sets a bit (including bit 63) that is not set in XCOMP_BV. 

° Bytes 63:16 of the XSAVE header are not all 0. 

If none of these conditions cause a fault, the processor updates each state component / for which RFBM[/] = 1. 
XRSTOR updates state component j based on the value of bit / in the XSTATE_BV field of the XSAVE header: 


° If XSTATE_BV[/] = 0, the state component is set to its initial configuration. Section 13.6 specifies the initial 
configuration of each state component. 

If XSTATE_BV[1] = 0, the compacted form XRSTOR initializes MXCSR to 1F80H. (This differs from the standard 
from of XRSTOR, which loads MXCSR from the XSAVE area whenever either RFBM[1] or RFBM[2] is set.) 
State component / is set to its initial configuration as indicated above if RFBM[/] = 1 and XSTATE_BV[/] = 0 — 
even if XCOMP_BV[i] = 0. This is true for all values of i, including 0 (x87 state) and 1 (SSE state). 

* If XSTATE_BV[/] = 1, the state component is loaded with data from the XSAVE area.! See Section 13.5 for 
specifics for each state component and for details regarding mode-specific operation and operation determined 
by instruction prefixes. See Section 13.13 for details regarding faults caused by memory accesses. 

State components 0 and 1 are located in the legacy region of the XSAVE area (see Section 13.4.1). Each state 
component /, 2 <i< 62, is located in the extended region; the compacted form of the XRSTOR instruction uses 
the compacted format for the extended region (see Section 13.4.3). 


The MXCSR register is part of SSE state (see Section 13.5.2) and is thus loaded from memory if RFBM[1] = 
XSTATE_BV[/] = 1. The compacted form of XRSTOR does not consider RFBM[2] (AVX) when determining whether 
to update MXCSR. (This is a difference from the standard form of XRSTOR.) The compacted form of XRSTOR causes 
a general-protection exception (#GP) if it would load MXCSR with an illegal value. 


13.8.3. XRSTOR and the Init and Modified Optimizations 
Execution of the XRSTOR instruction causes the processor to update its tracking for the init and modified optimiza- 
tions (see Section 13.6). The following items provide details: 
¢ The processor updates its tracking for the init optimization as follows: 
— If RFBM[/] = 0, XINUSE[/] is not changed. 


— If RFBM[/] = 1 and XSTATE_BV[/] = 0, state component / may be tracked as init; XINUSE[/] may be set to 
0 or 1. (As noted in Section 13.6, a processor need not implement the init optimization for state component 
i; a processor that does not do so implicitly maintains XINUSE[/] = 1 at all times.) 


— If RFBM[/] = 1 and XSTATE_BV[/] = 1, state component i is tracked as not init; XINUSE[/] is set to 1. 


¢ The processor updates its tracking for the modified optimization and records information about the XRSTOR 
execution for future interaction with the XSAVEOPT and XSAVES instructions (see Section 13.9 and Section 
13.11) as follows: 


— If RFBM[/] = 0, state component jis tracked as modified; XMODIFIED[/] is set to 1. 


— If RFBM[/] = 1, state component i may be tracked as unmodified; XMODIFIED[/] may be set to 0 or 1. (As 
noted in Section 13.6, a processor need not implement the modified optimization for state component /; a 
processor that does not do so implicitly maintains XMODIFIED[/] = 1 at all times.) 


1. Earlier fault checking ensured that, if the instruction has reached this point in execution and XSTATE_BV[i] is 1, then XCOMP_BV[i] is 
also 1. 
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— XRSTOR_INFO is set to the 4-tuple (w,x,y,z), where w is the CPL (0); x is 1 if the logical processor is in VMX 
non-root operation and 0 otherwise; y is the linear address of the XSAVE area; and z is XCOMP_BV. In 
particular, the standard form of XRSTOR always sets z to all zeroes, while the compacted form of XRSTORS 
never does so (because it sets at least bit 63 to 1). 


Note that, if RFBM is entirely zero (e.g., because the instruction mask in EDX:EAX is zero), no state components are 
modified, the XINUSE bitmap is not modified, and all bits are set in the XMODIFIED bitmap. Thus, if EDX:EAX was 
zero for the most recent execution of XRSTOR, an execution of XSAVEOPT or XSAVES will identify all state compo- 
nents as modified and will thus not use the modified optimization. 


13.9 OPERATION OF XSAVEOPT 


The operation of XSAVEOPT is similar to that of XSAVE. Unlike XSAVE, XSAVEOPT uses the init optimization (by 
which it may omit saving state components that are in their initial configuration) and the modified optimization (by 
which it may omit saving state components that have not been modified since the last execution of XRSTOR); see 
Section 13.6. See Section 13.2 for details of how to determine whether XSAVEOPT is supported. 


The XSAVEOPT instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. The logical (bitwise) AND of XCRO and the instruction mask is the requested-feature bitmap (RFBM) of 
the user state components to be saved. 

The following conditions cause execution of the XSAVEOPT instruction to generate a fault: 

e If the XSAVE feature set is not enabled (CR4.OSXSAVE = 0), an invalid-opcode exception (#UD) occurs. 

e If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 

* If the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) occurs.! 

If none of these conditions cause a fault, execution of XSAVEOPT reads the XSTATE_BV field of the XSAVE header 
(see Section 13.4.2) and writes it back to memory, setting XSTATE_BV[/] (0 <i < 63) as follows: 

e If RFBM[/] = 0, XSTATE_BV[/] is not changed. 

e If RFBM[/] = 1, XSTATE_BV[/] is set to the value of XINUSE[/]. Section 13.6 defines XINUSE to describe the 


processor init optimization and specifies the initial configuration of each state component. The nature of that 
optimization implies the following: 


— Ifthe state component is in its initial configuration, XINUSE[/] may be either 0 or 1, and XSTATE_BV[/] may 
be written with either 0 or 1. 


XINUSE[1] pertains only to the state of the XMM registers and not to MXCSR. Thus, XSTATE_BV[1] may be 
written with 0 even if MXCSR does not have its RESET value of 1F80H. 


— Ifthe state component is not in its initial configuration, XSTATE_BV[/] is written with 1. 


(As explained in Section 13.6, the initial configurations of some state components may depend on whether the 
processor is in 64-bit mode.) 


The XSAVEOPT instruction does not write any part of the XSAVE header other than the XSTATE_BV field; in partic- 
ular, it does not write to the XCOMP_BV field. 


Execution of XSAVEOPT saves into the XSAVE area those state components corresponding to bits that are set in 
RFBM (subject to the optimizations described below). State components 0 and 1 are located in the legacy region of 
the XSAVE area (see Section 13.4.1). Each state component /, 2 <i < 62, is located in the extended region; the 
XSAVEOPT instruction always uses the standard format for the extended region (see Section 13.4.3). 


See Section 13.5 for specifics for each state component and for details regarding mode-specific operation and 
operation determined by instruction prefixes. See Section 13.13 for details regarding faults caused by memory 
accesses. 


Execution of XSAVEOPT performs two optimizations that reduce the amount of data written to memory: 


1. If CRO.AM = 1, CPL = 3, and EFLAGS.AC =1, an alignment-check exception (HAC) may occur instead of #GP. 
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¢ Init optimization. 
If XINUSE[/] = 0, state component / is not saved to the XSAVE area (even if RFBM[/] = 1). (See below for 
exceptions made for MXCSR.) 

° Modified optimization. 
Each execution of XRSTOR and XRSTORS establishes XRSTOR_INFO as a 4-tuple (w,x,y,z) (see Section 13.8.3 
and Section 13.12). Execution of XSAVEOPT uses the modified optimization only if the following all hold for the 
current value of XRSTOR_INFO: 


— w=CPL; 
— x = 1 if and only if the logical processor is in VMX non-root operation; 
— yis the linear address of the XSAVE area being used by XSAVEOPT; and 


— zis 00000000_OO000000H. (This last item implies that XSAVEOPT does not use the modified optimization 
if the last execution of XRSTOR used the compacted form, or if an execution of XRSTORS followed the last 
execution of XRSTOR.) 


If XSAVEOPT uses the modified optimization and XMODIFIED[/] = 0 (see Section 13.6), state component / is 
not saved to the XSAVE area. 

(In practice, the benefit of the modified optimization for state component ij depends on how the processor is 
tracking state component /; see Section 13.6. Limitations on the tracking ability may result in state component 
i being saved even though is in the same configuration that was loaded by the previous execution of XRSTOR.) 
Depending on details of the operating system, an execution of XSAVEOPT by a user application might use the 
modified optimization when the most recent execution of XRSTOR was by a different application. Because of 
this, Intel recommends the application software not use the XSAVEOPT instruction. 


The MXCSR register and MKCSR_MASK are part of SSE state (see Section 13.5.2) and are thus associated with 
bit 1 of RFBM. However, the XSAVEOPT instruction also saves these values when RFBM[2] = 1 (even if RFBM[1] = 
0). The init and modified optimizations do not apply to the MXCSR register and MKCSR_MASK. 


13.10 OPERATION OF XSAVEC 


The operation of XSAVEC is similar to that of XSAVE. Two main differences are (1) XSAVEC uses the compacted 
format for the extended region of the XSAVE area; and (2) XSAVEC uses the init optimization (see Section 13.6). 
Unlike XSAVEOPT, XSAVEC does not use the modified optimization. See Section 13.2 for details of how to deter- 
mine whether XSAVEC is supported. 


The XSAVEC instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. The logical (bitwise) AND of XCRO and the instruction mask is the requested-feature bitmap (RFBM) of 
the user state components to be saved. 


The following conditions cause execution of the XSAVEC instruction to generate a fault: 
¢ If the XSAVE feature set is not enabled (CR4.0SXSAVE = 0), an invalid-opcode exception (#UD) occurs. 
° If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 

e If the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) occurs. 


If none of these conditions cause a fault, execution of XSAVEC writes the XSTATE_BV field of the XSAVE header 
(see Section 13.4.2), setting XSTATE_BV[/] (0 <i < 63) as follows: 

¢ If RFBM[/] = 0, XSTATE_BV[/] is written as 0. 

° If RFBM[/] = 1, XSTATE_BV[/] is set to the value of XINUSE[/] (see below for an exception made for 


XSTATE_BV[1]). Section 13.6 defines XINUSE to describe the processor init optimization and specifies the 
initial configuration of each state component. The nature of that optimization implies the following: 


1 


— If state component / is in its initial configuration, XSTATE_BV[/] may be written with either 0 or 1. 


1. If CRO.AM = 1, CPL = 3, and EFLAGS.AC =1, an alignment-check exception (HAC) may occur instead of #GP. 
2. Unlike the XSAVE and XSAVEOPT instructions, the XSAVEC instruction does not read the XSTATE_BV field of the XSAVE header. 
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— If state component / is not in its initial configuration, XSTATE_BV[/] is written with 1. 


XINUSE[1] pertains only to the state of the XMM registers and not to MXCSR. However, if RFBM[1] = 1 and 
MXCSR does not have the value 1F80H, XSAVEC writes XSTATE_BV[1] as 1 even if XINUSE[1] = 0. 


(As explained in Section 13.6, the initial configurations of some state components may depend on whether the 
processor is in 64-bit mode.) 


The XSAVEC instructions sets bit 63 of the XCOMP_BV field of the XSAVE header while writing RFBM[62:0] to 
XCOMP_BV[62:0]. The XSAVEC instruction does not write any part of the XSAVE header other than the XSTATE_BV 
and XCOMP_BV fields. 


Execution of XSAVEC saves into the XSAVE area those state components corresponding to bits that are set in RFBM 
(subject to the init optimization described below). State components 0 and 1 are located in the legacy region of the 
XSAVE area (see Section 13.4.1). Each state component i, 2 <i < 62, is located in the extended region; the XSAVEC 
instruction always uses the compacted format for the extended region (see Section 13.4.3). 


See Section 13.5 for specifics for each state component and for details regarding mode-specific operation and 
operation determined by instruction prefixes. See Section 13.13 for details regarding faults caused by memory 
accesses. 


Execution of XSAVEC performs the init optimization to reduce the amount of data written to memory. If 
XINUSE[/] = 0, state component / is not saved to the XSAVE area (even if RFBM[/] = 1). However, if RFBM[1] = 1 
and MXCSR does not have the value 1F80H, XSAVEC saves all of state component 1 (SSE — including the XMM 
registers) even if XINUSE[1] = 0. Unlike the XSAVE instruction, RFBM[2] does not determine whether XSAVEC 
saves MXCSR and MXCSR_MASK. 


13.11 OPERATION OF XSAVES 


The operation of XSAVES is similar to that of XSAVEC. The main differences are (1) XSAVES can be executed only 
if CPL = 0; (2) XSAVES can operate on the state components whose bits are set in XCRO | IA32_XSS and can thus 
operate on supervisor state components; and (3) XSAVES uses the modified optimization (see Section 13.6). See 
Section 13.2 for details of how to determine whether XSAVES is supported. 


The XSAVES instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. EDX:EAX & (XCRO | IA32_XSS) (the logical AND the instruction mask with the logical OR of XCRO and 
IA32_XSS) is the requested-feature bitmap (RFBM) of the state components to be saved. 


The following conditions cause execution of the XSAVES instruction to generate a fault: 
e If the XSAVE feature set is not enabled (CR4.OSXSAVE = 0), an invalid-opcode exception (#UD) occurs. 
e If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 


° If CPL > O or if the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) 
occurs. 


If none of these conditions cause a fault, execution of XSAVES writes the XSTATE_BV field of the XSAVE header 
(see Section 13.4.2), setting XSTATE_BV[/] (0 <i < 63) as follows: 


e If RFBM[/] = 0, XSTATE_BV[/] is written as 0. 


e If RFBM[/] = 1, XSTATE_BV[/] is set to the value of XINUSE[/] (see below for an exception made for 
XSTATE_BV[1]). Section 13.6 defines XINUSE to describe the processor init optimization and specifies the 
initial configuration of each state component. The nature of that optimization implies the following: 


— If state component / is in its initial configuration, XSTATE_BV[/] may be written with either 0 or 1. 
— If state component / is not in its initial configuration, XSTATE_BV[/] is written with 1. 


XINUSE[1] pertains only to the state of the XMM registers and not to MXCSR. However, if RFBM[1] = 1 and 
MXCSR does not have the value 1F80H, XSAVES writes XSTATE_BV[1] as 1 even if XINUSE[1] = 0. 


(As explained in Section 13.6, the initial configurations of some state components may depend on whether the 
processor is in 64-bit mode.) 
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The XSAVES instructions sets bit 63 of the XCOMP_BV field of the XSAVE header while writing RFBM[62:0] to 
XCOMP_BV[62:0]. The XSAVES instruction does not write any part of the XSAVE header other than the XSTATE_BV 
and XCOMP_BV fields. 


Execution of XSAVES saves into the XSAVE area those state components corresponding to bits that are set in RFBM 
(subject to the optimizations described below). State components 0 and 1 are located in the legacy region of the 
XSAVE area (see Section 13.4.1). Each state component /, 2 <i < 62, is located in the extended region; the XSAVES 
instruction always uses the compacted format for the extended region (see Section 13.4.3). 


See Section 13.5 for specifics for each state component and for details regarding mode-specific operation and 
operation determined by instruction prefixes; in particular, see Section 13.5.6, Section 13.5.11, Section 13.5.12, 
and Section 13.5.14 for special treatment by XSAVES of PT state, UINTR state, LBR state, and AMX state, respec- 
tively. See Section 13.13 for details regarding faults caused by memory accesses. 


Execution of XSAVES performs the init optimization to reduce the amount of data written to memory. If 
XINUSE[/] = 0, state component / is not saved to the XSAVE area (even if RFBM[/] = 1). However, if RFBM[1] = 1 
and MXCSR does not have the value 1F80H, XSAVES saves all of state component 1 (SSE — including the XMM 
registers) even if XINUSE[1] = 0. 


Like XSAVEOPT, XSAVES may perform the modified optimization. Each execution of XRSTOR and XRSTORS estab- 
lishes XRSTOR_INFO as a 4-tuple (w,x,y,z) (see Section 13.8.3 and Section 13.12). Execution of XSAVES uses the 
modified optimization only if the following all hold: 


° w=CPL,; 
¢ x = 1 if and only if the logical processor is in VMX non-root operation; 
e  yis the linear address of the XSAVE area being used by XSAVEOPT; and 


° z[63] is 1 and z[62:0] = RFBM[62:0]. (This last item implies that XSAVES does not use the modified optimi- 
zation if the last execution of XRSTOR used the standard form and followed the last execution of XRSTORS.) 


If XSAVES uses the modified optimization and XMODIFIED[/] = 0 (see Section 13.6), state component j is not 
saved to the XSAVE area. 


13.12 OPERATION OF XRSTORS 


The operation of XRSTORS is similar to that of XRSTOR. Three main differences are (1) XRSTORS can be executed 
only if CPL = 0; (2) XRSTORS can operate on the state components whose bits are set in XCRO | IA32_XSS and can 
thus operate on supervisor state components; and (3) XRSTORS has only a compacted form (no standard form; 
see Section 13.8). See Section 13.2 for details of how to determine whether XRSTORS is supported. 


The XRSTORS instruction takes a single memory operand, which is an XSAVE area. In addition, the register pair 
EDX:EAX is an implicit operand used as a state-component bitmap (see Section 13.1) called the instruction 
mask. EDX:EAX & (XCRO | IA32_XSS) (the logical AND the instruction mask with the logical OR of XCRO and 
IA32_XSS) is the requested-feature bitmap (RFBM) of the state components to be restored. 


The following conditions cause execution of the XRSTOR instruction to generate a fault: 
¢ If the XSAVE feature set is not enabled (CR4.0SXSAVE = 0), an invalid-opcode exception (#UD) occurs. 
° If CRO.TS[bit 3] is 1, a device-not-available exception (#NM) occurs. 


° If CPL > 0 or if the address of the XSAVE area is not 64-byte aligned, a general-protection exception (#GP) 
occurs. 


After checking for these faults, the XRSTORS instruction reads the first 64 bytes of the XSAVE header, including the 
XSTATE_BV and XCOMP_BV fields (see Section 13.4.2). A #GP occurs if any of the following conditions hold for the 
values read: 


¢ XCOMP_BV[63] = 0. 

¢ XCOMP_BV sets a bit in the range 62:0 that is not set in XCRO | IA32_XSS. 
¢ XSTATE_BV sets a bit (including bit 63) that is not set in XCOMP_BV. 

¢ Bytes 63:16 of the XSAVE header are not all 0. 
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If none of these conditions cause a fault, the processor updates each state component / for which RFBM[/] = 1. 
XRSTORS updates state component ij based on the value of bit / in the XSTATE_BV field of the XSAVE header: 


¢ If XSTATE_BV[/] = 0, the state component is set to its initial configuration. Section 13.6 specifies the initial 
configuration of each state component. If XSTATE_BV[1] = 0, XRSTORS initializes MXCSR to 1F80H. 


State component / is set to its initial configuration as indicated above if RFBM[/] = 1 and XSTATE_BV[/] = 0 — 
even if XCOMP_BV[/] = 0. This is true for all values of /, including 0 (x87 state) and 1 (SSE state). 


* If XSTATE_BV[/] = 1, the state component is loaded with data from the XSAVE area.! See Section 13.5 for 
specifics for each state component and for details regarding mode-specific operation and operation determined 
by instruction prefixes; in particular, see Section 13.5.6 and Section 13.5.12 for special treatment by XRSTORS 
of PT state and LBR state, respectively. See Section 13.13 for details regarding faults caused by memory 
accesses. 


If XRSTORS is restoring a supervisor state component, the instruction causes a general-protection exception 
(#GP) if it would load any element of that component with an unsupported value (e.g., by setting a reserved bit 
in an MSR) or if a bit is set in any reserved portion of the state component in the XSAVE area. 

State components 0 and 1 are located in the legacy region of the XSAVE area (see Section 13.4.1). Each state 
component /, 2 <i < 62, is located in the extended region; XRSTORS uses the compacted format for the 
extended region (see Section 13.4.3). 

The MXCSR register is part of SSE state (see Section 13.5.2) and is thus loaded from memory if RFBM[1] = 
XSTATE_BV[/] = 1. XRSTORS causes a general-protection exception (#GP) if it would load MXCSR with an 
illegal value. 


If an execution of XRSTORS causes an exception or a VM exit during or after restoring a supervisor state compo- 

nent, each element of that state component may have the value it held before the XRSTORS execution, the value 
loaded from the XSAVE area, or the element's initial value (as defined in Section 13.6). See Section 13.5.6 for some 
special treatment of PT state for the case in which XRSTORS causes an exception or a VM exit. 


Like XRSTOR, execution of XRSTORS causes the processor to update is tracking for the init and modified optimiza- 
tions (see Section 13.6 and Section 13.8.3). The following items provide details: 


¢ The processor updates its tracking for the init optimization as follows: 
— If RFBM[/] = 0, XINUSE[/] is not changed. 
— If RFBM[/] = 1 and XSTATE_BV[/] = 0, state component / may be tracked as init; XINUSE[/] may be set to 
Oorl. 
— If RFBM[/] = 1 and XSTATE_BV[/] = 1, state component jis tracked as not init; XINUSE[/] is set to 1.2 
¢ The processor updates its tracking for the modified optimization and records information about the XRSTORS 
execution for future interaction with the XSAVEOPT and XSAVES instructions as follows: 
— If RFBM[/] = 0, state component j is tracked as modified; XMODIFIED[/] is set to 1. 
— If RFBM[/] = 1, state component / may be tracked as unmodified; XMODIFIED[/] may be set to 0 or 1. 


— XRSTOR_INFO is set to the 4-tuple (w,x,y,z), where w is the CPL; x is 1 if the logical processor is in VMX 
non-root operation and 0 otherwise; y is the linear address of the XSAVE area; and z is XCOMP_BV (this 
implies that z[63] = 1). 


Note that, if RFBM is entirely zero (e.g., because the instruction mask in EDX:EAX is zero), no state components are 
modified, the XINUSE bitmap is not modified, and all bits are set in the XMODIFIED bitmap. Thus, if EDX:EAX was 
zero for the most recent execution of XRSTORS, an execution of XSAVEOPT or XSAVES will identify all state compo- 
nents as modified and will thus not use the modified optimization. 


1. Earlier fault checking ensured that, if the instruction has reached this point in execution and XSTATE_BV[i] is 1, then XCOMP_BV[i] is 
also 1. 


2. For LBR state (state component 15), XRSTORS may leave XINIUSE[15] unmodified in certain situations even if RFBM[15] = 1 = 
XSTATE_BV[15] = 1. See Section 13.5.12. 
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13.13 MEMORY ACCESSES BY THE XSAVE FEATURE SET 


Each instruction in the XSAVE feature set operates on a set of XSAVE-managed state components. The specific set 
of components on which an instruction operates is determined by the values of XCRO, the IA32_XSS MSR, 
EDX:EAX, and (for XRSTOR and XRSTORS) the XSAVE header. 


Section 13.4 provides the details necessary to determine the location of each state component for any execution of 
an instruction in the XSAVE feature set. An execution of an instruction in the XSAVE feature set may access any 
byte of any state component on which that execution operates even when saving a state component is omitted 
because it is in its initial configuration; when restoring a state component to its initial configuration; or when XFD 
is enabled for the state components (see Section 13.14). 


Section 13.5 provides details of the different XSAVE-managed state components. Some portions of some of these 
components are accessible only in 64-bit mode. Executions of XRSTOR and XRSTORS outside 64-bit mode will not 
update those portions; executions of XSAVE, XSAVEC, XSAVEOPT, and XSAVES will not modify the corresponding 
locations in memory. 


Despite this fact, any execution of these instructions outside 64-bit mode may access any byte in any state compo- 
nent on which that execution operates — even those at addresses corresponding to registers that are accessible 
only in 64-bit mode. As a result, such an execution may incur a fault due to an attempt to access such an address. 


For example, an execution of XSAVE outside 64-bit mode may incur a page fault if paging does not map as 
read/write the section of the XSAVE area containing state component 7 (Hi16_ZMM state) — despite the fact that 
state component 7 can be accessed only in 64-bit mode. 


13.14 EXTENDED FEATURE DISABLE (XFD) 


Extended feature disable (XFD) is an extension to the XSAVE feature set that allows an operating system to 
enable a feature while preventing specific user threads from using the feature. This section describes XFD. 


As noted in Section 13.2, a processor that supports XFD enumerates CPUID.(EAX=0DH,ECX=1):EAX[4] as 1. Such 
a processor supports two new MSRs: IA32_XFD (MSR address 1C4H) and IA32_XFD_ERR (MSR address 1C5H). 
Each of these MSRs contains a state-component bitmap. Bit / of either MSR can be set to 1 only if 
CPUID.(EAX=0DH,ECX=/):ECX[2] is enumerated as 1 (see Section 13.2). An execution of WRMSR that attempts to 
set an unsupported bit in either MSR causes a general-protection fault (#GP). The reset values of both of these 
MSRs are zero. 


XFD is enabled for state component i if XCRO[/] = IA32_XFD[/] = 1. (IA32_XFD[/] does not affect processor oper- 
ations if XCRO[/] = 0.) In compacted format, the IA32_XFD MSR does not impact the computation of XCOMP_BV by 
the XSAVEC or XSAVES instructions and thus does not impact the format of the extended region of the XSAVE area. 
When XFD is enabled for a state component, any instruction that would access that state component does not 
execute and instead generates a device-not-available exception (#NM). 


Exceptions are made for certain instructions (including those that initialize the state component). The following 
items provide details: 


¢ LDTILECFG and TILERELEASE initialize the TILEDATA state component. An execution of either of these instruc- 
tions does not generate #NM when XCRO[18] = IA32_XFD[18] = 1; instead, it initializes TILEDATA normally. 
(Note that STTILECFG does not use the TILEDATA state component. Thus, an execution of this instruction does 
not generate #NM when XCRO[18] = IA32_XFD[18] = 1.) 


¢ If XRSTOR or XRSTORS is loading state component j and bit / of the XSTATE_BV field of the XSAVE header is 0, 
the instruction does not generate #NM when XCRO[/] = IA32_XFD[/] = 1; instead, it initializes the state 
component normally. (If bit / of the XSTATE_BV field of the XSAVE header is 1, the instruction does generate 
#NM.) 


° If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component /, the instruction does not generate 
#NM when XCRO[/] = IA32_XFD[/] = 1; instead, it operates as if XINUSE[i] = 0 (and the state component was 
in its initial state): it saves bit / of XSTATE_BV field of the XSAVE header as O; in addition, XSAVE saves the 
initial configuration of the state component (the other instructions do not save state component /). 

¢ Enclave entry instructions (ENCLU[EENTER] and ENCLU[ERESUME]) generate #NM if XCRO[/] = IA32_XFD[/] = 
1 and bit / is set in the XFRM field in the attributes of the enclave being entered. 
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When XFD causes an instruction to generate #NM, the processor loads the IA32_XFD_ERR MSR to identify the 
disabled state component(s). Specifically, the MSR is loaded with the logical AND of the IA32_XFD MSR and the 
bitmap corresponding to the state component(s) required by the faulting instruction. 


Device-not-available exceptions that are not due to XFD — those resulting from setting CRO.TS to 1 — do not 
modify the IA32_XFD_ERR MSR. 
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3. Updates to Chapter 1, Volume 2A 


Change bars and violet text show changes to Chapter 1 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2A: Instruction Set Reference, A-L. 


Changes to this chapter: 


e Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processors to 
the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.” 
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CHAPTER 1 
ABOUT THIS MANUAL 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D: Instruction Set 
Reference (order numbers 253666, 253667, 326018, and 334569), is part of a set that describes the architecture 
and programming environment of all Intel 64 and IA-32 architecture processors. Other volumes in this set are: 


* The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (Order 
Number 253665). 


* The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D: System 
Programming Guide (order numbers 253668, 253669, 326019, and 332831). 


° The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers 
(order number 335592). 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture 
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describes the instruction set of the processor and the opcode struc- 
ture. These volumes apply to application programmers and to programmers who write operating systems or exec- 
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describes 
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating- 
system and BIOS designers. In addition, the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3B, addresses the programming environment for classes of software that host operating systems. The 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, describes the model-specific registers 
of Intel 64 and IA-32 processors. 


1.1 INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL 


This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which 
include: 


* Pentium® processors 

° P6 family processors 

* Pentium® 4 processors 

* Pentium® M processors 

* Intel® Xeon® processors 

* Pentium® D processors 

* Pentium® processor Extreme Editions 

* 64-bit Intel® Xeon® processors 

* Intel® Core™ Duo processor 

* Intel® Core™ Solo processor 

* Dual-Core Intel® Xeon® processor LV 

* Intel® Core™ 2 Duo processor 

* Intel® Core™ 2 Quad processor Q6000 series 

* Intel® xeon® processor 3000, 3200 series 

* Intel® Xeon® processor 5000 series 

* Intel® xeon® processor 5100, 5300 series 

* Intel® Core™ 2 Extreme processor X7000 and X6800 series 
* Intel® Core™ 2 Extreme processor QX6000 series 
* Intel® Xeon® processor 7100 series 
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* Intel® Pentium® Dual-Core processor 

* Intel® Xeon® processor 7200, 7300 series 

* Intel® xeon® processor 5200, 5400, 7400 series 

* Intel® Core™ 2 Extreme processor QX9000 and X9000 series 
* Intel® Core™ 2 Quad processor Q9000 series 

* Intel® Core™ 2 Duo processor E8000, T9000 series 

* Intel Atom® processor family 


* Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are built from 45 nm and 32 nm processes 


* Intel® Core™ i7 processor 

* Intel® Core™ i5 processor 

* Intel® Xeon® processor E7-8800/4800/2800 product families 
* Intel® Core™ i7-3930K processor 

* 2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series 
* Intel® Xeon® processor E3-1200 product family 

* Intel® Xeon® processor E5-2400/1400 product family 

* Intel® Xeon® processor E5-4600/2600/1600 product family 
* 3rd generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1200 v2 product family 

* Intel® Xeon® processor E5-2400/1400 v2 product families 

* Intel® Xeon® processor E5-4600/2600/1600 v2 product families 
* Intel® Xeon® processor E7-8800/4800/2800 v2 product families 
* 4th generation Intel® Core™ processors 

* The Intel® Core™ M processor family 

* Intel® Core™ i7-59xx Processor Extreme Edition 

* Intel® Core™ i7-49xx Processor Extreme Edition 

* Intel® Xeon® processor E3-1200 v3 product family 

* Intel® Xeon® processor E5-2600/1600 v3 product families 

* 5th generation Intel® Core™ processors 

* Intel® Xeon® processor D-1500 product family 

* Intel® Xeon® processor E5 v4 family 

* Intel Atom® processor X7-Z8000 and X5-Z8000 series 

* Intel Atom® processor Z3400 series 

* Intel Atom® processor Z3500 series 

* 6th generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1500m v5 product family 

* 7th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series 

* Intel® Xeon® Scalable Processor Family 

* 8th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 

* Intel® Xeon® E processors 

* 9th generation Intel® Core™ processors 

* 2nd generation Intel® Xeon® Scalable Processor Family 
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* 10th generation Intel® Core™ processors 

* 11th generation Intel® Core™ processors 

* 3rd generation Intel® Xeon® Scalable Processor Family 
* 12th generation Intel® Core™ processors 

* 13th generation Intel® Core™ processors 

* 4th generation Intel® Xeon® Scalable Processor Family 
* 5th generation Intel® Xeon® Scalable Processor Family 
* Intel® Core™ Ultra 7 processors 


P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium® 
Pro, Pentium® II, Pentium® III, and Pentium® III Xeon® processors. 


The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® microar- 
chitecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon 
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture. 


The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved 
Pentium® M processor microarchitecture. 


The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Quad, and Intel® Core™ 2 Extreme processors are based on Intel® Core™ microar- 
chitecture. 


The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™ 2 Quad processor Q9000 series, and Intel® 
Core™ 2 Extreme processors QX9000, X9000 series, Intel® Core™ 2 processor E8000 series are based on 
Enhanced Intel® Core™ microarchitecture. 


The Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are based on the Intel Atom® microarchitecture and supports Intel 64 architecture. 


P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV, 
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® Atom™ 
processor Z5xx series support IA-32 architecture. 


The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Extreme, Intel® Core™ 2 Quad processors, Pentium® D processors, Pentium® Dual- 
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture. 


The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem 
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel® 
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the 
Westmere microarchitecture. These processors support Intel 64 architecture. 


The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7- 
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx, 
Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product 
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support 
Intel 64 architecture. 


The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2 
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec- 
ture and support Intel 64 architecture. 


The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on 
the Haswell microarchitecture and support Intel 64 architecture. 


The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme 
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture. 


The Intel Atom® processor Z8000 series is based on the Airmont microarchitecture. 
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The Intel Atom® processor Z3400 series and the Intel Atom® processor Z3500 series are based on the Silvermont 
microarchitecture. 


The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500 
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® Scalable Processor Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener- 
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture. 


The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64 
architecture. 


The Intel Atom® processor C series, the Intel Atom® processor X series, the Intel® Pentium® processor J series, 
the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Goldmont 
microarchitecture. 


The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and 
supports Intel 64 architecture. 


The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron® 
processor N series are based on the Goldmont Plus microarchitecture. 


The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces- 
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture. 


The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and 
supports Intel 64 architecture. 


The 2nd generation Intel® Xeon® Scalable Processor Family is based on the Cascade Lake product and supports 
Intel 64 architecture. 


Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based 
on the Comet Lake microarchitecture; both support Intel 64 architecture. 


Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are 
based on the Rocket Lake microarchitecture; both support Intel 64 architecture. 


Some 3rd generation Intel® Xeon® Scalable Processor Family processors are based on the Cooper Lake product, 
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture. 


The 12th generation Intel® Core™ processors are based on the Alder Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 13th generation Intel® Core™ processors are based on the Raptor Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and 
supports Intel 64 architecture. 


The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and 
supports Intel 64 architecture. 


The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and supports Intel 64 architecture. 


IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces- 
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset 
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture. 


1.2 OVERVIEW OF VOLUME 2A, 2B, 2C, AND 2D: INSTRUCTION SET 
REFERENCE 


A description of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, 
content follows: 
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Chapter 1 — About This Manual. Gives an overview of all ten volumes of the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual. It also describes the notational conventions in these manuals and lists related Intel® 
manuals and documentation of interest to programmers and hardware designers. 


Chapter 2 — Instruction Format. Describes the machine-level instruction format used for all IA-32 instructions 
and gives the allowable encodings of prefixes, the operand-identifier byte (ModR/M byte), the addressing-mode 
specifier byte (SIB byte), and the displacement and immediate bytes. 


Chapter 3 — Instruction Set Reference, A-L. Describes Intel 64 and IA-32 instructions in detail, including an 
algorithmic description of operations, the effect on flags, the effect of operand- and address-size attributes, and 

the exceptions that may be generated. The instructions are arranged in alphabetical order. General-purpose, x87 
FPU, Intel MMX™ technology, SSE/SSE2/SSE3/SSSE3/SSE4 extensions, and system instructions are included. 


Chapter 4 — Instruction Set Reference, M-U. Continues the description of Intel 64 and IA-32 instructions 
started in Chapter 3. It starts Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2B. 


Chapter 5 — Instruction Set Reference, V. Continues the description of Intel 64 and IA-32 instructions started 
in chapters 3 and 4. This chapter starts Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
2C. 


Chapter 6 — Instruction Set Reference, W-Z. Continues the description of Intel 64 and IA-32 instructions 
started in chapters 3, 4, and 5. It provides the balance of the alphabetized list of instructions and starts Intel® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 2D. 


Chapter 7 — Safer Mode Extensions Reference. Describes the safer mode extensions (SMX). SMX is intended 
for a system executive to support launching a measured environment in a platform where the identity of the soft- 
ware controlling the platform hardware can be measured for the purpose of making trust decisions. 


Chapter 8— Instruction Set Reference Unique to Intel® Xeon Phi™ Processors. Describes the instruction 
set that is unique to Intel® Xeon Phi™ processors based on the Knights Landing and Knights Mill microarchitec- 
tures. The set is not supported in any other Intel processors. 


Appendix A — Opcode Map. Gives an opcode map for the IA-32 instruction set. 


Appendix B — Instruction Formats and Encodings. Gives the binary encoding of each form of each IA-32 
instruction. 


Appendix C — Intel® C/C++ Compiler Intrinsics and Functional Equivalents. Lists the Intel® C/C++ compiler 
intrinsics and their assembly code equivalents for each of the IA-32 MMX and SSE/SSE2/SSE3 instructions. 


13 NOTATIONAL CONVENTIONS 


This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for 
hexadecimal and binary numbers. A review of this notation makes the manual easier to read. 


1.3.1 Bit and Byte Order 


In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses 
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to 
two raised to the power of the bit position. IA-32 processors are “little endian” machines; this means the bytes of 
a word are numbered starting from the least significant byte. Figure 1-1 illustrates these conventions. 
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Highest Data Structure 
Address 31 24 23 16 15 87 0 ~«— Bit offset 


Lowest 
Address 


Byte Offset 


Figure 1-1. Bit and Byte Order 


1.3.2 Reserved Bits and Software Compatibility 


In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as 
reserved, it is essential for compatibility with future processors that software treat these bits as having a future, 
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict- 
able. Software should follow these guidelines in dealing with reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers which contain such bits. 
Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 


¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, or 
reload them with values previously read from the same register. 


NOTE 


Avoid any software dependence upon the state of reserved bits in IA-32 registers. Depending upon 
the values of reserved register bits will make software dependent upon the unspecified manner in 

which the processor handles these bits. Programs that depend upon reserved values risk incompat- 
ibility with future processors. 


1.3.3 Instruction Operands 
When instructions are represented symbolically, a subset of the IA-32 assembly language is used. In this subset, 
an instruction has the following format: 
label: mnemonic argument1, argument2, argument3 
where: 
¢ A label is an identifier which is followed by a colon. 
¢ A mnemonic is a reserved name for a class of instruction opcodes which have the same function. 


¢ The operands argumenti, argument2, and argument3 are optional. There may be from zero to three operands, 
depending on the opcode. When present, they take the form of either literals or identifiers for data items. 
Operand identifiers are either reserved names of registers or are assumed to be assigned to data items 
declared in another part of the program (which may not be shown in the example). 


When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left 
operand is the destination. 


For example: 
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LOADREG: MOV EAX, SUBTOTAL 


In this example, LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand, 
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order. 


1.3.4 Hexadecimal and Binary Numbers 


Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for 
example, F82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, 
E, and F. 


Base 2 (binary) numbers are represented by a string of 1s and Os, sometimes followed by the character B (for 
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might 
arise. 


1.3.5 Segmented Addressing 


The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes. 
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes in memory. The 
range of memory that can be addressed is called an address space. 


The processor also supports segmented addressing. This is a form of addressing where a program may have many 
independent address spaces, called segments. For example, a program can keep its code (instructions) and stack 
in separate segments. Code addresses would always refer to the code space, and stack addresses would always 
refer to the stack space. The following notation is used to specify a byte address within a segment: 
Segment-register:Byte-address 
For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS 
register: 
DS:FF79H 
The following segment address identifies an instruction address in the code segment. The CS register points to the 
code segment and the EIP register contains the address of the instruction. 


CS:EIP 


1.3.6 Exceptions 


An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to 
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi- 
tions. Some types of exceptions may provide error codes. An error code reports additional information about the 
error. An example of the notation used to show an exception and error code is shown below: 


#PF(fault code) 


This example refers to a page-fault exception under conditions where an error code naming a type of fault is 
reported. Under some conditions, exceptions which produce error codes may not be able to report an accurate 
code. In this case, the error code is zero, as shown below for a general-protection exception: 


#GP(0) 


1.3.7 A New Syntax for CPUID, CR, and MSR Values 


Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register 
bits, and by reading model-specific registers. We are moving toward a new syntax to represent this information. 
See Figure 1-2. 
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CPUID Input and Output 


CPUID.01H:EDX.SSE[bit 25] = 1 
e | @ 


Input value for EAX register 


Output register and feature flag or field 
name with bit position(s) 


Value (or range) of output 


Control Register Values 


CR4.OSFXSR)Ibit 9] = 1 
e | © 


Example CR name 


Feature flag or field name 
with bit position(s) 


Value (or range) of output 


Model-Specific Register Values 


IA32_MISC_ENABLE.ENABLEFOPCODED[bit 2] = 1 
|! 


Example MSR name 


Feature flag or field name with bit position(s) 


Value (or range) of output 


Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation 


1.4 RELATED LITERATURE 


Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at: 
https://software.intel.com/en-us/articles/intel-sdm 
See also: 


* The latest security information on Intel® products: 
https://www.intel.com/content/www/us/en/security-center/default.html 


° Software developer resources, guidance, and insights for security advisories: 
https://software.intel.com/security-software-guidance/ 


¢ The data sheet for a particular Intel 64 or IA-32 processor 
¢ The specification update for a particular Intel 64 or IA-32 processor 


* Intel® C++ Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 
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Intel® Fortran Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


Intel® Software Development Tools: 
https://software.intel.com/en-us/intel-sdp-home 


Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four or ten volumes): 
https://software.intel.com/en-us/articles/intel-sdm 


Intel® 64 and IA-32 Architectures Optimization Reference Manual: 
https://software.intel.com/en-us/articles/intel-sdm#optimization 


Intel® Trusted Execution Technology Measured Launched Environment Programming Guide: 
http://www. intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html 


Intel® Software Guard Extensions (Intel® SGX) Information: 
https://software.intel.com/en-us/isa-extensions/intel-sgx 


Developing Multi-threaded Applications: A Platform Consistent Approach: 
https://software.intel.com/sites/default/files/article/147714/51534-developing-multithreaded-applica- 
tions. pdf 


Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor: 
https://software.intel.com/sites/default/files/22/30/25602 


Performance Monitoring Unit Sharing Guide: 
http://software.intel.com/file/30388 


Literature related to select features in future Intel processors are available at: 


Intel® Architecture Instruction Set Extensions Programming Reference: 
https://software.intel.com/en-us/isa-extensions 


More relevant links are: 


Intel® Developer Zone: 

https://software.intel.com/en-us 

Developer centers: 

http://www. intel.com/content/www/us/en/hardware-developers/developer-centers.html 
Processor support general link: 

http://www. intel.com/support/processors/ 

Intel® Hyper-Threading Technology (Intel® HT Technology): 

http://www. intel.com/technology/platform-technology/hyper-threading/index.htm 
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4. Updates to Chapter 2, Volume 2A 


Change bars and violet text show changes to Chapter 2 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2A: Instruction Set Reference, A-L. 


Changes to this chapter: 


e Updated Section 2.2.1, “REX Prefixes,” to clarify that only one meaningful REX prefix is allowed per 
instruction. 


e Corrected two inaccurate cross-references in Section 2.3.12, “Vector SIB (VSIB) Memory Addressing.” 
Previously, this section contained two references to Table 2-3; the correct table is Table 2-13. 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 
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CHAPTER 2 
INSTRUCTION FORMAT 


This chapter describes the instruction format for all Intel 64 and IA-32 processors. The instruction format for 
protected mode, real-address mode and virtual-8086 mode is described in Section 2.1. Increments provided for IA- 
32e mode and its sub-modes are described in Section 2.2. 


ZI INSTRUCTION FORMAT FOR PROTECTED MODE, REAL-ADDRESS MODE, 
AND VIRTUAL-8086 MODE 


The Intel 64 and IA-32 architectures instruction encodings are subsets of the format shown in Figure 2-1. Instruc- 
tions consist of optional instruction prefixes (in any order), primary opcode bytes (up to three bytes), an 
addressing-form specifier (if required) consisting of the ModR/M byte and sometimes the SIB (Scale-Index-Base) 
byte, a displacement (if required), and an immediate data field (if required). 


Prefixes of _1-, 2-, or 3-byte 1 byte 1 byte Address Immediate 
1 byte each opcode (if required) (if aie displacement data of 
(optional): 2 of 1, 2, or 4 1,2,0r4 
ra \ bytes or none® _ bytes or none® 
7 65 32 0 7 65 32 0 


io 


1. The REX prefix is optional, but if used must be immediately before the opcode; see Section 
2.2.1, “REX Prefixes” for additional information. 

2. For VEX encoding information, see Section 2.3, “Intel® Advanced Vector Extensions (Intel® 
AVX)”. 

3. Some rare instructions can take an 8B immediate or 8B displacement. 


Figure 2-1. Intel 64 and IA-32 Architectures Instruction Format 


2.1.1 Instruction Prefixes 


Instruction prefixes are divided into four groups, each with a set of allowable prefix codes. For each instruction, it 
is only useful to include up to one prefix code from each of the four groups (Groups 1, 2, 3, 4). Groups 1 through 4 
may be placed in any order relative to each other. 


° Group 1 
— Lock and repeat prefixes: 
¢ LOCK prefix is encoded using FOH. 


¢ REPNE/REPNZ prefix is encoded using F2H. Repeat-Not-Zero prefix applies only to string and 
input/output instructions. (F2H is also used as a mandatory prefix for some instructions. ) 


¢ REP or REPE/REPZ is encoded using F3H. The repeat prefix applies only to string and input/output 
instructions. (F3H is also used as a mandatory prefix for some instructions.) 
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— BND prefix is encoded using F2H if the following conditions are true: 
¢ CPUID.(EAX=07H, ECX=0):EBX.MPX[bit 14] is set. 
¢ BNDCFGU.EN and/or IA32_BNDCFGS.EN is set. 
¢ When the F2 prefix precedes a near CALL, a near RET, a near JMP, a short Jcc, or a near Jcc instruction 
(see Appendix E, “Intel® Memory Protection Extensions,” of the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 1). 
° Group 2 
— Segment override prefixes: 
¢ 2EH—CS segment override (use with any branch instruction is reserved). 
¢ 36H—SS segment override prefix (use with any branch instruction is reserved). 
¢ 3EH—DS segment override prefix (use with any branch instruction is reserved). 
¢ 26H—ES segment override prefix (use with any branch instruction is reserved). 
¢ 64H—FS segment override prefix (use with any branch instruction is reserved). 
* 65H—GS segment override prefix (use with any branch instruction is reserved). 
— Branch hints?: 
¢ 2EH—Branch not taken (used only with Jcc instructions). 
¢ 3EH—Branch taken (used only with Jcc instructions). 
° Group 3 
¢ Operand-size override prefix is encoded using 66H (66H is also used as a mandatory prefix for some 
instructions). 
° Group 4 
* 67H—Address-size override prefix. 


The LOCK prefix (FOH) forces an operation that ensures exclusive use of shared memory in a multiprocessor envi- 
ronment. See “LOCK—Assert LOCK# Signal Prefix” in Chapter 3, “Instruction Set Reference, A-L,” for a description 
of this prefix. 

Repeat prefixes (F2H, F3H) cause an instruction to be repeated for each element of a string. Use these prefixes 
only with string and I/O instructions (MOVS, CMPS, SCAS, LODS, STOS, INS, and OUTS). Use of repeat prefixes 
and/or undefined opcodes with other Intel 64 or IA-32 instructions is reserved; such use may cause unpredictable 
behavior. 

Some instructions may use F2H,F3H as a mandatory prefix to express distinct functionality. 

Branch hint prefixes (2EH, 3EH) allow a program to give a hint to the processor about the most likely code path for 
a branch. Use these prefixes only with conditional branch instructions (Jcc). Other use of branch hint prefixes 
and/or other undefined opcodes with Intel 64 or IA-32 instructions is reserved; such use may cause unpredictable 
behavior. 

The operand-size override prefix allows a program to switch between 16- and 32-bit operand sizes. Either size can 
be the default; use of the prefix selects the non-default size. 

Some SSE2/SSE3/SSSE3/SSE4 instructions and instructions using a three-byte sequence of primary opcode bytes 
may use 66H as a mandatory prefix to express distinct functionality. 

Other use of the 66H prefix is reserved; such use may cause unpredictable behavior. 

The address-size override prefix (67H) allows programs to switch between 16- and 32-bit addressing. Either size 
can be the default; the prefix selects the non-default size. Using this prefix and/or other undefined opcodes when 
operands for the instruction do not reside in memory is reserved; such use may cause unpredictable behavior. 


1. Some earlier microarchitectures used these as branch hints, but recent generations have not and they are reserved for future hint 
usage. 
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2alot Opcodes 


A primary opcode can be 1, 2, or 3 bytes in length. An additional 3-bit opcode field is sometimes encoded in the 
ModR/M byte. Smaller fields can be defined within the primary opcode. Such fields define the direction of opera- 
tion, size of displacements, register encoding, condition codes, or sign extension. Encoding fields used by an 
opcode vary depending on the class of operation. 


Two-byte opcode formats for general-purpose and SIMD instructions consist of one of the following: 
¢ An escape opcode byte OFH as the primary opcode and a second opcode byte. 


¢ Amandatory prefix (66H, F2H, or F3H), an escape opcode byte, and a second opcode byte (same as previous 
bullet). 


For example, CVTDQ2PD consists of the following sequence: F3 OF E6. The first byte is a mandatory prefix (it is not 
considered as a repeat prefix). 


Three-byte opcode formats for general-purpose and SIMD instructions consist of one of the following: 
e An escape opcode byte OFH as the primary opcode, plus two additional opcode bytes. 


¢ Amandatory prefix (66H, F2H, or F3H), an escape opcode byte, plus two additional opcode bytes (same as 
previous bullet). 


For example, PHADDW for XMM registers consists of the following sequence: 66 OF 38 01. The first byte is the 
mandatory prefix. 


Valid opcode expressions are defined in Appendix A and Appendix B. 


2.1.3 ModR/M and SIB Bytes 


Many instructions that refer to an operand in memory have an addressing-form specifier byte (called the ModR/M 
byte) following the primary opcode. The ModR/M byte contains three fields of information: 


° The mod field combines with the r/m field to form 32 possible values: eight registers and 24 addressing modes. 


° The reg/opcode field specifies either a register number or three more bits of opcode information. The purpose 
of the reg/opcode field is specified in the primary opcode. 


¢ The r/m field can specify a register as an operand or it can be combined with the mod field to encode an 
addressing mode. Sometimes, certain combinations of the mod field and the r/m field are used to express 
opcode information for some instructions. 


Certain encodings of the ModR/M byte require a second addressing byte (the SIB byte). The base-plus-index and 
scale-plus-index forms of 32-bit addressing require the SIB byte. The SIB byte includes the following fields: 


° The scale field specifies the scale factor. 

° The index field specifies the register number of the index register. 
° The base field specifies the register number of the base register. 
See Section 2.1.5 for the encodings of the ModR/M and SIB bytes. 


2.1.4 Displacement and Immediate Bytes 


Some addressing forms include a displacement immediately following the ModR/M byte (or the SIB byte if one is 
present). If a displacement is required, it can be 1, 2, or 4 bytes. 


If an instruction specifies an immediate operand, the operand always follows any displacement bytes. An imme- 
diate operand can be 1, 2 or 4 bytes. 
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2.1.5 Addressing-Mode Encoding of ModR/M and SIB Bytes 


The values and corresponding addressing forms of the ModR/M and SIB bytes are shown in Table 2-1 through Table 
2-3: 16-bit addressing forms specified by the ModR/M byte are in Table 2-1 and 32-bit addressing forms are in 
Table 2-2. Table 2-3 shows 32-bit addressing forms specified by the SIB byte. In cases where the reg/opcode field 
in the ModR/M byte represents an extended opcode, valid encodings are shown in Appendix B. 


In Table 2-1 and Table 2-2, the Effective Address column lists 32 effective addresses that can be assigned to the 
first operand of an instruction by using the Mod and R/M fields of the ModR/M byte. The first 24 options provide 
ways of specifying a memory location; the last eight (Mod = 11B) provide ways of specifying general-purpose, MMX 
technology and XMM registers. 


The Mod and R/M columns in Table 2-1 and Table 2-2 give the binary encodings of the Mod and R/M fields required 
to obtain the effective address listed in the first column. For example: see the row indicated by Mod = 11B, R/M = 
OOOB. The row identifies the general-purpose registers EAX, AX or AL; MMX technology register MMO; or XMM 
register XMMO. The register used is determined by the opcode byte and the operand-size attribute. 


Now look at the seventh row in either table (labeled “REG =”). This row specifies the use of the 3-bit Reg/Opcode 
field when the field is used to give the location of a second operand. The second operand must be a general- 
purpose, MMX technology, or XMM register. Rows one through five list the registers that may correspond to the 
value in the table. Again, the register used is determined by the opcode byte along with the operand-size attribute. 


If the instruction does not require a second operand, then the Reg/Opcode field may be used as an opcode exten- 
sion. This use is represented by the sixth row in the tables (labeled “/digit (Opcode)”). Note that values in row six 
are represented in decimal form. 

The body of Table 2-1 and Table 2-2 (under the label “Value of ModR/M Byte (in Hexadecimal)”) contains a 32 by 
8 array that presents all of 256 values of the ModR/M byte (in hexadecimal). Bits 3, 4, and 5 are specified by the 

column of the table in which a byte resides. The row specifies bits 0, 1, and 2; and bits 6 and 7. The figure below 

demonstrates interpretation of one table value. 


Mod 11 

RM 000 
/digit (Opcode); REG= 001 

C8H 11001000 


Figure 2-2. Table Interpretation of ModR/M Byte (C8H) 
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Table 2-1. 16-Bit Addressing Forms with the ModR/M Byte 


r8(/r) CH 
r16(/r) BP! 
r32(/r) EBP 
mmi(/r) MM5 
xmm(/r) XMM5 
(In decimal) /digit (Opcode) 0 1 2 3 4 5 

(In binary) REG = 101 


Effective Address odR/M Byte (in Hexadecimal) 


uw 
Oo}; NMMONDWYHO 


[BX+Sl-disp8? 
[BX+DI]+disp8 
[BP+SI}-+disp8 

[BP+DI}+disp8 


[Sl]+disp8 
[Di}+disp8 

[BP]}+disp8 
[BX]+disp8 


[BX+Sl-disp16 
[BX+DI]+disp16 
[BP+SI}-+disp16 
[BP+DI}+disp16 
[Sl}+disp16 
[Di}+disp16 
[BP]}+disp16 
[BX}+disp16 


EAX/AX/AL/MMO/XMMO 
ECX/CX/CL/MM1/XMM 1 
EDX/DX/DL/MM2/XMM2 
EBX/BX/BL/MM3/XMM3 
ESP/SP/AHMM4/XMM4. 
EBP/BP/CH/MM5/XMM5 
ESI/SI/DH/MM6/XMM6 
EDI/DI/BH/MM7/XMM7 


NOTES: 
1. The default segment register is SS for the effective addresses containing a BP index, DS for other effective addresses. 
2. The disp16 nomenclature denotes a 16-bit displacement that follows the ModR/M byte and that is added to the index. 


3. The disp8 nomenclature denotes an 8-bit displacement that follows the ModR/M byte and that is sign-extended and added to the 
index. 
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Table 2-2. 32-Bit Addressing Forms with the ModR/M Byte 


r8(/r) 

r16(/r) 

r32(/r) 

mm(/r) 

xmm(/r 

(In decimal) /digit (Opcode) 

(In binary) REG = 

Effective Address 

[EBX}+disp8 011 43 4B 53 5B 63 6B 73 7B 

[--][--]}+disp8 100 44 4c 54 5C 64 6C 74 7C 

[EBP]+disp8 101 45 4D 55 5D 65 6D 75 7D 

[ESI]+disp8 110 46 4€ 56 5E 66 6E 76 7E 

[EDI]+disp8 111 47 4F 57 5F 67 6F 77 7F 

[EAX]+disp32 10 000 80 88 90 98 AO A8 BO B8 

[ECX]+disp32 001 81 89 91 99 Al AS Bl B9 

[EDX]+disp32 010 82 8A 92 9A A2 AA B2 BA 

[EBX}+disp32 011 83 8B 93 9B A3 AB B3 BB 

[--][--]}+disp32 100 84 8C 94 9C A4 AC B4 BC 

[EBP]+disp32 101 85 8D 95 9D A5 AD B5 BD 

[ESI]+disp32 110 86 8E 96 9E AG AE B6 BE 

[EDI]+disp32 111 87 8F 97 OF A7 AF B7 BF 

EAX/AX/AL/MMO/XMMO 11 000 co C8 DO D8 E0 E8 FO F8 

ECX/CX/CL/MM/XMM 1 001 C1 cg D1 D9 €1 E9 FI F9 

EDX/DX/DL/MM2/XMM2 010 C2 CA D2 DA E2 EA F2 FA 

EBX/BX/BL/MM3/XMM3 011 C3 CB D3 DB €3 EB F3 FB 

ESP/SP/AH/MM4/XMM4 100 C4 CC D4 DC E4 EC F4 FC 

EBP/BP/CH/MM5/XMM5 101 cs CD D5 DD €5 ED F5 FD 

ESI/SI/DH/MM6/XMM6 110 C6 CE D6 DE €6 EE F6 FE 

EDI/DI/BH/MM7/XMM7 111 C7 CF D7 DF €7 EF F7 FF 
NOTES: 


1. The [--][--] nomenclature means a SIB follows the ModR/M byte. 

2. The disp32 nomenclature denotes a 32-bit displacement that follows the ModR/M byte (or the SIB byte if one is present) and that is 
added to the index. 

3. The disp8 nomenclature denotes an 8-bit displacement that follows the ModR/M byte (or the SIB byte if one is present) and that is 
sign-extended and added to the index. 


Table 2-3 is organized to give 256 possible values of the SIB byte (in hexadecimal). General purpose registers used 
as a base are indicated across the top of the table, along with corresponding values for the SIB byte’s base field. 
Table rows in the body of the table indicate the register used as the index (SIB byte bits 3, 4, and 5) and the scaling 
factor (determined by SIB byte bits 6 and 7). 
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Table 2-3. 32-Bit Addressing Forms with the SIB Byte 


r32 EDX EBX ESP [*] 
(In decimal) Base = 0 1 2 3 4 5 
(In binary) Base = 010 011 100 101 


Scaled Index Value of SIB Byte (in Hexadecimal) 


[EAX*4] 10 000 80 81 82 83 84 85 86 87 
[ECX*4] 001 88 89 8A 8B 8C 8D 8E 8F 
[EDX*4] 010 90 91 92 93 94 95 96 97 
[EBX*4] 011 98 99 9A 9B 9C 9D 9E 9F 
none 100 AO Al A2 A3 A4 A5 AG A7 
[EBP*4] 101 A8 AS AA AB AC AD AE AF 
[ESI*4] 110 BO B1 B2 B3 B4 B5 B6 B7 
[EDI*4] 111 B8 B9 BA BB BC BD BE BF 
[EAX*8] 11 000 co C1 C2 C3 C4 cS C6 C7 
[ECX*8] 001 c8 cg CA CB CC CD CE CF 
[EDX*8] 010 DO D1 D2 D3 D4 D5 D6 D7 
[EBX*8] 011 D8 D9 DA DB DC DD DE DF 
none 100 E0 E1 E2 E3 €4 €5 €6 E7 
[EBP*8] 101 €8 €9 EA EB EC ED EE EF 
[ES|*8] 110 FO FI F2 F3 F4 F5 F6 F7 
[EDI*8] 111 F8 F9 FA FB FE FD FE FF 
NOTES: 


— 


. The [*] nomenclature means a disp32 with no base if the MOD is OOB. Otherwise, [*] means disp8 or disp32 + [EBP]. This provides the 
following address modes: 


MOD bits Effective Address 


00 [scaled index] + disp32 
01 [scaled index] + disp8 + [EBP] 
10 [scaled index] + disp32 + [EBP] 


Va IA-32E MODE 


IA-32e mode has two sub-modes. These are: 


¢ Compatibility Mode. Enables a 64-bit operating system to run most legacy protected mode software 
unmodified. 


° 64-Bit Mode. Enables a 64-bit operating system to run applications written to access 64-bit address space. 


2.2.1 REX Prefixes 
REX prefixes are instruction-prefix bytes used in 64-bit mode. They do the following: 
° Specify GPRs and SSE registers. 
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° Specify 64-bit operand size. 
° Specify extended control registers. 


Not all instructions require a REX prefix in 64-bit mode. A prefix is necessary only if an instruction references one 
of the extended registers or uses a 64-bit operand. If a REX prefix is used when it has no meaning, it is ignored, as 
are individual bits in the prefix when they have no meaning. 


Only one meaningful REX prefix is allowed per instruction. If used, the REX prefix byte must immediately precede 
the opcode byte or the escape opcode byte (OFH). When a REX prefix is used in conjunction with an instruction 
containing a mandatory prefix, the mandatory prefix must come before the REX so the REX prefix can immediately 
precede the opcode or the escape byte. For example, CVTDQ2PD with a REX prefix should have REX placed 
between F3 and OF E6. Other placements are ignored. The instruction-size limit of 15 bytes still applies to instruc- 
tions with a REX prefix. See Figure 2-3. 


Grp 1,Grp (optional) —-1-, 2-, or 1 byte 1 byte Address Immediate data 
2, Grp 3, 3-byte (ifrequired) (ifrequired) — displacementof of 1,2,or4 
Grp 4 opcode 1,2,or4 bytes bytes or none 
(optional) 


Figure 2-3. Prefix Ordering in 64-bit Mode 


2.2.1.1 Encoding 


Intel 64 and IA-32 instruction formats specify up to three registers by using 3-bit fields in the encoding, depending 
on the format: 


° ModR/M: the reg and r/m fields of the ModR/M byte. 


® ModR/M with SIB: the reg field of the ModR/M byte, the base and index fields of the SIB (scale, index, base) 
byte. 


¢ Instructions without ModR/M: the reg field of the opcode. 


In 64-bit mode, these formats do not change. Bits needed to define fields in the 64-bit context are provided by the 
addition of REX prefixes. 


aa 4 More on REX Prefix Fields 


REX prefixes are a set of 16 opcodes that span one row of the opcode map and occupy entries 40H to 4FH. These 
opcodes represent valid instructions (INC or DEC) in IA-32 operating modes and in compatibility mode. In 64-bit 
mode, the same opcodes represent the instruction prefix REX and are not treated as individual instructions. 


The single-byte-opcode forms of the INC/DEC instructions are not available in 64-bit mode. INC/DEC functionality 
is still available using ModR/M forms of the same instructions (opcodes FF/O and FF/1). 


See Table 2-4 for a summary of the REX prefix format. Figure 2-4 though Figure 2-7 show examples of REX prefix 
fields in use. Some combinations of REX prefix fields are invalid. In such cases, the prefix is ignored. Some addi- 
tional information follows: 


° Setting REX.W can be used to determine the operand size but does not solely determine operand width. Like 
the 66H size prefix, 64-bit operand size override has no effect on byte-specific operations. 


¢ For non-byte operations: if a 66H prefix is used with prefix (REX.W = 1), 66H is ignored. 
¢ If a 66H override is used with REX and REX.W = 0, the operand size is 16 bits. 


° REX.R modifies the ModR/M reg field when that field encodes a GPR, SSE, control or debug register. REX.R is 
ignored when ModR/M specifies other registers or defines an extended opcode. 


° REX.X bit modifies the SIB index field. 
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REX.B either modifies the base in the ModR/M r/m field or SIB base field; or it modifies the opcode reg field 
used for accessing GPRs. 


Table 2-4. REX Prefix Fields [BITS: 0100WRXB] 


Figure 2-4. Memory Addressing Without an SIB Byte; REX.X Not Used 


Field Name Bit Position Definition 
- 74 0100 
W 3 O = Operand size determined by CS.D 
1 = 64 Bit Operand Size 
2 Extension of the ModR/M reg field 
1 Extension of the SIB index field 
0 Extension of the ModR/M r/m field, SIB base field, or Opcode reg field 
ModRM Byte 
REX PREFIX Opcode mod reg rim 
0100WROB #1 rer BPE 
inl 
OMI7xfigt-3 


ModRM Byte 
REX PREFIX Opcode mod reg rim 
0100WROB 1 rrr bbb 
(iE) 
Wy | | | 
Rrrr Bbbb 
OM17Xfig1-4 


Figure 2-5. Register-Register Addressing (No Memory Operand); REX.X Not Used 
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REX PREFIX Opcode 
0100WRXB 


ModRM Byte 


SIB Byte 


scale index | base 
ss XXX bbb 
\ 


ie 


Xxxx  Bbbb 


OM17Xfig1-5 


Figure 2-6. Memory Addressing With a SIB Byte 


REX PREFIX 
0100WO00B 


Opcode 


Bbbb 


OM17Xfig1-6 


Figure 2-7. Register Operand Coded in Opcode Byte; REX.X & REX.R Not Used 


In the IA-32 architecture, byte registers (AH, AL, BH, BL, CH, CL, DH, and DL) are encoded in the ModR/M byte’s 
reg field, the r/m field or the opcode reg field as registers 0 through 7. REX prefixes provide an additional 
addressing capability for byte-registers that makes the least-significant byte of GPRs available for byte operations. 


Certain combinations of the fields of the ModR/M byte and the SIB byte have special meaning for register encod- 
ings. For some combinations, fields expanded by the REX prefix are not decoded. Table 2-5 describes how each 


case behaves. 
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Table 2-5. Special Cases of REX Encodings 


ModR/M or __| Sub-field Compatibility Mode | Compatibility Mode 
SIB Encodings Operation Implications Additional Implications 
ModR/M Byte | mod ? 11 SIB byte present. SIB byte required for | REX prefix adds a fourth bit (b) which is not decoded 
r/m = ESP-based addressing. | (don’t care). 
b*100(ESP) SIB byte also required for R12-based addressing. 
ModR/M Byte |mod=0 Base register not EBP without a REX prefix adds a fourth bit (b) which is not decoded 
r/m = used. displacement must be | (don't care). 
b*101(EBP) done using Using RBP or R13 without displacement must be done 
mod = 01 with using mod = 01 with a displacement of 0. 
displacement of 0. 
SIB Byte index = Index register not ESP cannot be used as | REX prefix adds a fourth bit (b) which is decoded. 
0100(ESP) used. an index register. There are no additional implications. The expanded 
index field allows distinguishing RSP from R12, 
therefore R12 can be used as an index. 
SIB Byte base = Base register is Base register depends | REX prefix adds a fourth bit (b) which is not decoded. 
0101(€BP) unused ifmod=0, | on mod encoding. This requires explicit displacement to be used with 
EBP/RBP or R13. 
NOTES: 


* Don’t care about value of REX.B 


2.2.1.3 Displacement 


Addressing in 64-bit mode uses existing 32-bit ModR/M and SIB encodings. The ModR/M and SIB displacement 
sizes do not change. They remain 8 bits or 32 bits and are sign-extended to 64 bits. 


2.2.1.4 Direct Memory-Offset MOVs 


In 64-bit mode, direct memory-offset forms of the MOV instruction are extended to specify a 64-bit immediate 
absolute address. This address is called a moffset. No prefix is needed to specify this 64-bit memory offset. For 
these MOV instructions, the size of the memory offset follows the address-size default (64 bits in 64-bit mode). See 
Table 2-6. 


Table 2-6. Direct Memory Offset Form of MOV 


Opcode Instruction 

AO MOV AL, moffset 

Al MOV EAX, moffset 

A2 MOV moffset, AL 

A3 MOV moffset, EAX 
2.2.1.5 Immediates 


In 64-bit mode, the typical size of immediate operands remains 32 bits. When the operand size is 64 bits, the 
processor sign-extends all immediates to 64 bits prior to their use. 

Support for 64-bit immediate operands is accomplished by expanding the semantics of the existing move (MOV 
reg, imm16/32) instructions. These instructions (opcodes B8H - BFH) move 16-bits or 32-bits of immediate data 
(depending on the effective operand size) into a GPR. When the effective operand size is 64 bits, these instructions 
can be used to load an immediate into a GPR. A REX prefix is needed to override the 32-bit default operand size to 
a 64-bit operand size. 


For example: 


48B8 8877665544332211 MOV RAX,1122334455667788H 
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2.2.1.6 RIP-Relative Addressing 


A new addressing form, RIP-relative (relative instruction-pointer) addressing, is implemented in 64-bit mode. An 
effective address is formed by adding displacement to the 64-bit RIP of the next instruction. 


In IA-32 architecture and compatibility mode, addressing relative to the instruction pointer is available only with 
control-transfer instructions. In 64-bit mode, instructions that use ModR/M addressing can use RIP-relative 
addressing. Without RIP-relative addressing, all ModR/M modes address memory relative to zero. 

RIP-relative addressing allows specific ModR/M modes to address memory relative to the 64-bit RIP using a signed 
32-bit displacement. This provides an offset range of +2GB from the RIP. Table 2-7 shows the ModR/M and SIB 
encodings for RIP-relative addressing. Redundant forms of 32-bit displacement-addressing exist in the current 
ModR/M and SIB encodings. There is one ModR/M encoding and there are several SIB encodings. RIP-relative 
addressing is encoded using a redundant form. 

In 64-bit mode, the ModR/M Disp32 (32-bit displacement) encoding is re-defined to be RIP+Disp32 rather than 
displacement-only. See Table 2-7. 


Table 2-7. RIP-Relative Addressing 


ModR/M and SIB Sub-field Encodings | Compatibility Mode | 64-bit Mode Additional Implications in 64-bit mode 


Operation Operation 
ModR/M Byte | mod = 00 Disp32 RIP + Disp32 In 64-bit mode, if one wants to use a Disp32 
OL oe) SIB byte encoding (indicated by MocR/M/m=100) 
as described in the next row. 
SIB Byte base = 101 (none) If mod = 00, Disp32 | Same as legacy | None 
index = 100 (none) 
scale = 0, 1,2, 4 


The ModR/M encoding for RIP-relative addressing does not depend on using a prefix. Specifically, the r/m bit field 
encoding of 101B (used to select RIP-relative addressing) is not affected by the REX prefix. For example, selecting 
R13 (REX.B = 1, r/m = 101B) with mod = OOB still results in RIP-relative addressing. The 4-bit r/m field of REX.B 
combined with ModR/M is not fully decoded. In order to address R13 with no displacement, software must encode 
R13 + 0 using a 1-byte displacement of zero. 

RIP-relative addressing is enabled by 64-bit mode, not by a 64-bit address-size. The use of the address-size prefix 
does not disable RIP-relative addressing. The effect of the address-size prefix is to truncate and zero-extend the 
computed effective address to 32 bits. 


2.2.1.7 Default 64-Bit Operand Size 


In 64-bit mode, two groups of instructions have a default operand size of 64 bits (do not need a REX prefix for this 
operand size). These are: 


¢ Near branches. 
¢ All instructions, except far branches, that implicitly reference the RSP. 


2.2.0 Additional Encodings for Control and Debug Registers 


In 64-bit mode, more encodings for control and debug registers are available. The REX.R bit is used to modify the 
ModR/M reg field when that field encodes a control or debug register (see Table 2-4). These encodings enable the 
processor to address CR8-CR15 and DR8- DR15. An additional control register (CR8) is defined in 64-bit mode. CR8 
becomes the Task Priority Register (TPR). 

In the first implementation of IA-32e mode, CR9-CR1i5 and DR8-DR15 are not implemented. Any attempt to access 
unimplemented registers results in an invalid-opcode exception (#UD). 
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2.3 INTEL® ADVANCED VECTOR EXTENSIONS (INTEL® AVX) 


Intel AVX instructions are encoded using an encoding scheme that combines prefix bytes, opcode extension field, 
operand encoding fields, and vector length encoding capability into a new prefix, referred to as VEX. In the VEX 
encoding scheme, the VEX prefix may be two or three bytes long, depending on the instruction semantics. Despite 
the two-byte or three-byte length of the VEX prefix, the VEX encoding format provides a more compact represen- 
tation/packing of the components of encoding an instruction in Intel 64 architecture. The VEX encoding scheme 
also allows more headroom for future growth of Intel 64 architecture. 


2.3.1 Instruction Format 
Instruction encoding using VEX prefix provides several advantages: 


¢ Instruction syntax support for three operands and up-to four operands when necessary. For example, the third 
source register used by VBLENDVPD is encoded using bits 7:4 of the immediate byte. 


¢ Encoding support for vector length of 128 bits (using XMM registers) and 256 bits (using YMM registers). 
¢ Encoding support for instruction syntax of non-destructive source operands. 


° Elimination of escape opcode byte (OFH), SIMD prefix byte (66H, F2H, F3H) via a compact bit field represen- 
tation within the VEX prefix. 


¢ Elimination of the need to use REX prefix to encode the extended half of general-purpose register sets (R8- 
R15) for direct register access, memory addressing, or accessing XMM8-XMM15 (including YMM8-YMM15). 


¢ Flexible and more compact bit fields are provided in the VEX prefix to retain the full functionality provided by 
REX prefix. REX.W, REX.X, REX.B functionalities are provided in the three-byte VEX prefix only because only a 
subset of SIMD instructions need them. 


¢  ~=Extensibility for future instruction extensions without significant instruction length increase. 


Figure 2-8 shows the Intel 64 instruction encoding format with VEX prefix support. Legacy instruction without a 
VEX prefix is fully supported and unchanged. The use of VEX prefix in an Intel 64 instruction is optional, but a VEX 
prefix is required for Intel 64 instructions that operate on YMM registers or support three and four operand syntax. 
VEX prefix is not a constant-valued, “single-purpose” byte like OFH, 66H, F2H, F3H in legacy SSE instructions. VEX 
prefix provides substantially richer capability than the REX prefix. 


# Bytes 2,3 0,1 0,1,2,4 0,1 


1 1 ; 


Figure 2-8. Instruction Encoding Format with VEX Prefix 


2.3.2 VEX and the LOCK prefix 
Any VEX-encoded instruction with a LOCK prefix preceding VEX will #UD. 


2.3.3 VEX and the 66H, F2H, and F3H prefixes 
Any VEX-encoded instruction with a 66H, F2H, or F3H prefix preceding VEX will #UD. 


2.3.4 VEX and the REX prefix 
Any VEX-encoded instruction with a REX prefix proceeding VEX will #UD. 
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2.3.5 The VEX Prefix 


The VEX prefix is encoded in either the two-byte form (the first byte must be C5H) or in the three-byte form (the 
first byte must be C4H). The two-byte VEX is used mainly for 128-bit, scalar, and the most common 256-bit AVX 
instructions; while the three-byte VEX provides a compact replacement of REX and 3-byte opcode instructions 
(including AVX and FMA instructions). Beyond the first byte of the VEX prefix, it consists of a number of bit fields 
providing specific capability, they are shown in Figure 2-9. 

The bit fields of the VEX prefix can be summarized by its functional purposes: 


° Non-destructive source register encoding (applicable to three and four operand syntax): This is the first source 
operand in the instruction syntax. It is represented by the notation, VEX.vvvv. This field is encoded using 1’s 
complement form (inverted form), i.e., XMMO/YMMO/RO is encoded as 1111B, XMM15/YMM15/R15 is encoded 
as OOOOB. 


¢ Vector length encoding: This 1-bit field represented by the notation VEX.L. L= 0 means vector length is 128 bits 
wide, L=1 means 256 bit vector. The value of this field is written as VEX.128 or VEX.256 in this document to 
distinguish encoded values of other VEX bit fields. 


¢ REX prefix functionality: Full REX prefix functionality is provided in the three-byte form of VEX prefix. However 
the VEX bit fields providing REX functionality are encoded using 1’s complement form, i.e., XMMO/YMMO/RO is 
encoded as 1111B, XMM15/YMM15/R15 is encoded as OOOOB. 


— Two-byte form of the VEX prefix only provides the equivalent functionality of REX.R, using 1’s complement 
encoding. This is represented as VEX.R. 


— Three-byte form of the VEX prefix provides REX.R, REX.X, REX.B functionality using 1’s complement 
encoding and three dedicated bit fields represented as VEX.R, VEX.X, VEX.B. 


— Three-byte form of the VEX prefix provides the functionality of REX.W only to specific instructions that need 
to override default 32-bit operand size for a general purpose register to 64-bit size in 64-bit mode. For 
those applicable instructions, VEX.W field provides the same functionality as REX.W. VEX.W field can 
provide completely different functionality for other instructions. 


Consequently, the use of REX prefix with VEX encoded instructions is not allowed. However, the intent of the 
REX prefix for expanding register set is reserved for future instruction set extensions using VEX prefix 
encoding format. 


* Compaction of SIMD prefix: Legacy SSE instructions effectively use SIMD prefixes (66H, F2H, F3H) as an 
opcode extension field. VEX prefix encoding allows the functional capability of such legacy SSE instructions 
(operating on XMM registers, bits 255:128 of corresponding YMM unmodified) to be encoded using the VEX.pp 
field without the presence of any SIMD prefix. The VEX-encoded 128-bit instruction will zero-out bits 255:128 
of the destination register. VEX-encoded instruction may have 128 bit vector length or 256 bits length. 


* Compaction of two-byte and three-byte opcode: More recently introduced legacy SSE instructions employ two 
and three-byte opcode. The one or two leading bytes are: OFH, and OFH 3AH/OFH 38H. The one-byte escape 
(OFH) and two-byte escape (OFH 3AH, OFH 38H) can also be interpreted as an opcode extension field. The 
VEX.mmmmm field provides compaction to allow many legacy instruction to be encoded without the constant 
byte sequence, OFH, OFH 3AH, OFH 38H. These VEX-encoded instruction may have 128 bit vector length or 256 
bits length. 


The VEX prefix is required to be the last prefix and immediately precedes the opcode bytes. It must follow any other 
prefixes. If VEX prefix is present a REX prefix is not supported. 


The 3-byte VEX leaves room for future expansion with 3 reserved bits. REX and the 66h/F2h/F3h prefixes are 
reclaimed for future use. 


VEX prefix has a two-byte form and a three byte form. If an instruction syntax can be encoded using the two-byte 
form, it can also be encoded using the three byte form of VEX. The latter increases the length of the instruction by 
one byte. This may be helpful in some situations for code alignment. 


The VEX prefix supports 256-bit versions of floating-point SSE, SSE2, SSE3, and SSE4 instructions. Note, certain 
new instruction functionality can only be encoded with the VEX prefix. 


The VEX prefix will #UD on any instruction containing MMX register sources or destinations. 
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Byte 0 Byte | 
(Bit Position) 7 07654 


=s 
2-byte VEX ios 


R: REX.R in 1’s complement (inverted) form 
1: Same as REX.R=0 (must be | in 32-bit mode) 
0: Same as REX.R=1 (64-bit mode only) 
X: REX.X in 1’s complement (inverted) form 
1: Same as REX.X=0 (must be | in 32-bit mode) 
0: Same as REX.X=1 (64-bit mode only) 
B: REX.B in 1’s complement (inverted) form 
1: Same as REX.B=0 (Ignored in 32-bit mode). 
0: Same as REX.B=1 (64-bit mode only) 
W: opcode specific (use like REX.W, or used for opcode 
extension, or ignored, depending on the opcode byte) 


3.210 


m-mmmm: 
00000: Reserved for future use (will #UD) 
00001: implied OF leading opcode byte 
00010: implied OF 38 leading opcode bytes 
00011: implied OF 3A leading opcode bytes 
00100-11111: Reserved for future use (will #UD) 


wvvv: a register specifier (in 1’s complement form) or 1111 if unused. 


L: Vector Length 


0: scalar or 128-bit vector 
1: 256-bit vector 


pp: opcode extension providing equivalent functionality of a SIMD prefix 
00: None 
O01: 66 
10: F3 
11: F2 


Figure 2-9. VEX bit fields 


The following subsections describe the various fields in two or three-byte VEX prefix. 


2.3.5.1 VEX Byte 0, bits[7:0] 


VEX Byte 0, bits [7:0] must contain the value 11000101b (C5h) or 11000100b (C4h). The 3-byte VEX uses the C4h 
first byte, while the 2-byte VEX uses the C5h first byte. 


2.3.5.2 VEX Byte 1, bit [7] - 


VEX Byte 1, bit [7] contains a bit analogous to a bit inverted REX.R. In protected and compatibility modes the bit 
must be set to ‘1’ otherwise the instruction is LES or LDS. 
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This bit is present in both 2- and 3-byte VEX prefixes. 


The usage of WRXB bits for legacy instructions is explained in detail section 2.2.1.2 of Intel 64 and IA-32 Architec- 
tures Software developer’s manual, Volume 2A. 


This bit is stored in bit inverted format. 


2.3.5.3. 3-byte VEX byte 1, bit[6] - ‘Xx’ 


Bit[6] of the 3-byte VEX byte 1 encodes a bit analogous to a bit inverted REX.X. It is an extension of the SIB Index 
field in 64-bit modes. In 32-bit modes, this bit must be set to ‘1’ otherwise the instruction is LES or LDS. 


This bit is available only in the 3-byte VEX prefix. 
This bit is stored in bit inverted format. 


2.3.5.4 3-byte VEX byte 1, bit[5] - ‘B’ 


Bit[5] of the 3-byte VEX byte 1 encodes a bit analogous to a bit inverted REX.B. In 64-bit modes, it is an extension 
of the ModR/M r/m field, or the SIB base field. In 32-bit modes, this bit is ignored. 


This bit is available only in the 3-byte VEX prefix. 
This bit is stored in bit inverted format. 


2.3.5.5  3-byte VEX byte 2, bit[7] - ‘W’ 


Bit[7] of the 3-byte VEX byte 2 is represented by the notation VEX.W. It can provide following functions, depending 

on the specific opcode. 

e For AVX instructions that have equivalent legacy SSE instructions (typically these SSE instructions have a 
general-purpose register operand with its operand size attribute promotable by REX.W), if REX.W promotes 
the operand size attribute of the general-purpose register operand in legacy SSE instruction, VEX.W has same 
meaning in the corresponding AVX equivalent form. In 32-bit modes for these instructions, VEX.W is silently 
ignored. 

e For AVX instructions that have equivalent legacy SSE instructions (typically these SSE instructions have oper- 
ands with their operand size attribute fixed and not promotable by REX.W), if REX.W is don’t care in legacy 
SSE instruction, VEX.W is ignored in the corresponding AVX equivalent form irrespective of mode. 

e For new AVX instructions where VEX.W has no defined function (typically these meant the combination of the 
opcode byte and VEX.mmmmm did not have any equivalent SSE functions), VEX.W is reserved as zero and 
setting to other than zero will cause instruction to #UD. 


2.3.5.6 2-byte VEX Byte 1, bits[6:3] and 3-byte VEX Byte 2, bits [6:3]- ‘vvvv' the Source or Dest 
Register Specifier 

In 32-bit mode the VEX first byte C4 and C5 alias onto the LES and LDS instructions. To maintain compatibility with 

existing programs the VEX 2nd byte, bits [7:6] must be 11b. To achieve this, the VEX payload bits are selected to 

place only inverted, 64-bit valid fields (extended register selectors) in these upper bits. 

The 2-byte VEX Byte 1, bits [6:3] and the 3-byte VEX, Byte 2, bits [6:3] encode a field (shorthand VEX.vvvv) that 

for instructions with 2 or more source registers and an XMM or YMM or memory destination encodes the first source 

register specifier stored in inverted (1’s complement) form. 

VEX.vvvv is not used by the instructions with one source (except certain shifts, see below) or on instructions with 

no XMM or YMM or memory destination. If an instruction does not use VEX.vvvv then it should be set to 1111b 

otherwise instruction will #UD. 

In 64-bit mode all 4 bits may be used. See Table 2-8 for the encoding of the XMM or YMM registers. In 32-bit and 

16-bit modes bit 6 must be 1 (if bit 6 is not 1, the 2-byte VEX version will generate LDS instruction and the 3-byte 

VEX version will ignore this bit). 
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Table 2-8. VEX.vvvv to register name mapping 


VEX.vvv Dest Register ag ere at Valid gree a aa 
1111B XMMO/YMMO RAX/EAX Valid 
1110B XMM1/YMM1 RCX/ECX Valid 
1101B XMM2/YMM2 RDX/EDX Valid 
1100B XMM3/YMM3 RBX/EBX Valid 
1011B XMM4/YMM4 RSP/ESP Valid 
1010B XMM5/YMM5 RBP/EBP Valid 
1001B XMM6/YMM6 RSI/ESI Valid 
1000B XMM7/YMM7 RDI/EDI Valid 
0111B XMM8/YMM8 R8/R8D Invalid 
0110B XMM9/YMM9 R9/RSD Invalid 
0101B XMM10/YMM10 R10/R10D Invalid 
0100B XMM11/YMM11 R11/R11D Invalid 
0011B XMM12/YMM12 R12/R12D Invalid 
0010B XMM13/YMM13 R13/R13D Invalid 
0001B XMM14/YMM14 R14/R14D Invalid 
0000B XMM15/YMM15 R15/R15D Invalid 

NOTES: 


1. See Section 2.6, “VEX Encoding Support for GPR Instructions” for additional details. 
2. Only the first eight General-Purpose Registers are accessible/encodable in 16/32b modes. 


The VEX.vvvv field is encoded in bit inverted format for accessing a register operand. 


2.3.6 Instruction Operand Encoding and VEX.vvvv, ModR/M 


VEX-encoded instructions support three-operand and four-operand instruction syntax. Some VEX-encoded 
instructions have syntax with less than three operands, e.g., VEX-encoded pack shift instructions support one 


source operand and one destination operand). 


The roles of VEX.vvvv, reg field of ModR/M byte (ModR/M.reg), r/m field of ModR/M byte (ModR/M.r/m) with 
respect to encoding destination and source operands vary with different type of instruction syntax. 


The role of VEX.vvvv can be summarized to three situations: 
° VEX.vvvv encodes the first source register operand, specified in inverted (1’s complement) form and is valid for 


instructions with 2 or more source operands. 


¢ VEX.vvvv encodes the destination register operand, specified in 1’s complement form for certain vector shifts. 
The instructions where VEX.vvvv is used as a destination are listed in Table 2-9. The notation in the “Opcode” 
column in Table 2-9 is described in detail in section 3.1.1. 


¢ VEX.vvvv does not encode any operand, the field is reserved and should contain 1111b. 


Table 2-9. Instructions with a VEX.vvvv destination 


Opcode 


Instruction mnemonic 


VEX.128.66.0F 73 /7 ib 


VPSLLDQ xmm1, xmm_2, imm8 


VEX.128.66.0F 73 /3 ib 


VPSRLDQ xmm1, xmm2, imm8 


VEX.128.66.0F 71 /2 ib 


VPSRLW xmm1, xmmz, imm8 


VEX.128.66.0F 72 /2 ib 


VPSRLD xmm1, xmm2, imm8 


VEX.128.66.0F 73 /2 ib 


VPSRLO xmm1, xmm2, imm8 


VEX.128.66.0F 71 /4 ib 


VPSRAW xmm1, xmm_2, imm8 
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Opcode Instruction mnemonic 
VEX.128.66.0F 72 /4 ib VPSRAD xmm1, xmm2, imm8 
VEX.128.66.0F 71 /6 ib VPSLLW xmm1, xmm2, imm8s 
VEX.128.66.0F 72 /6 ib VPSLLD xmm1, xmm2, imm8 
VEX.128.66.0F 73 /6 ib VPSLLQ xmm1, xmm2, imm8 


The role of ModR/M.r/m field can be summarized to two situations: 
® ModR/M.r/m encodes the instruction operand that references a memory address. 


° For some instructions that do not support memory addressing semantics, ModR/M.r/m encodes either the 
destination register operand or a source register operand. 


The role of ModR/M.reg field can be summarized to two situations: 
® ModR/M.reg encodes either the destination register operand or a source register operand. 


° For some instructions, ModR/M.reg is treated as an opcode extension and not used to encode any instruction 
operand. 


For instruction syntax that support four operands, VEX.vvvv, ModR/M.r/m, ModR/M.reg encodes three of the four 
operands. The role of bits 7:4 of the immediate byte serves the following situation: 


¢ Imm8[7:4] encodes the third source register operand. 


2.3.6.1 3-byte VEX byte 1, bits[4:0] - “m-mmmm”" 


Bits[4:0] of the 3-byte VEX byte 1 encode an implied leading opcode byte (OF, OF 38, or OF 3A). Several bits are 
reserved for future use and will #UD unless 0. 


Table 2-10. VEX.m-mmmm interpretation 


VEX.m-mmmm Implied Leading Opcode Bytes 
00000B Reserved 
00001B OF 
00010B OF 38 
00011B OF 3A 
00100-11111B Reserved 
(2-byte VEX) OF 


VEX.m-mmmm is only available on the 3-byte VEX. The 2-byte VEX implies a leading OFh opcode byte. 


2.3.6.2 2-byte VEX byte 1, bit[2], and 3-byte VEX byte 2, bit [2]- “L” 


The vector length field, VEX.L, is encoded in bit[2] of either the second byte of 2-byte VEX, or the third byte of 3- 
byte VEX. If “VEX.L = 1”, it indicates 256-bit vector operation. “VEX.L = 0” indicates scalar and 128-bit vector 
operations. 


The instruction VZEROUPPER is a special case that is encoded with VEX.L = 0, although its operation zero’s bits 
255:128 of all YMM registers accessible in the current operating mode. 


See the following table. 
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Table 2-11. VEX.L interpretation 


VEX.L Vector Length 
0 128-bit (or 32/64-bit scalar) 
1 256-bit 


2.3.6.3 2-byte VEX byte 1, bits[1:0], and 3-byte VEX byte 2, bits [1:0]- “pp” 


Up to one implied prefix is encoded by bits[1:0] of either the 2-byte VEX byte 1 or the 3-byte VEX byte 2. The prefix 
behaves as if it was encoded prior to VEX, but after all other encoded prefixes. 


See the following table. 


Table 2-12. VEX.pp interpretation 


pp Implies this prefix after other prefixes but before VEX 
00B None 
01B 66 
10B F3 
11B F2 


23.7 The Opcode Byte 


One (and only one) opcode byte follows the 2 or 3 byte VEX. Legal opcodes are specified in Appendix B, in color. 
Any instruction that uses illegal opcode will #UD. 


2.3.8 The ModR/M, SIB, and Displacement Bytes 


The encodings are unchanged but the interpretation of reg_field or rm_field differs (see above). 


2.3.9 The Third Source Operand (Immediate Byte) 


VEX-encoded instructions can support instruction with a four operand syntax. VBLENDVPD, VBLENDVPS, and 
PBLENDVB use imm8[7:4] to encode one of the source registers. 


2.3.10 Intel® AVX Instructions and the Upper 128-bits of YMM registers 


If an instruction with a destination XMM register is encoded with a VEX prefix, the processor zeroes the upper bits 
(above bit 128) of the equivalent YMM register. Legacy SSE instructions without VEX preserve the upper bits. 


2.3.10.1 Vector Length Transition and Programming Considerations 

An instruction encoded with a VEX.128 prefix that loads a YMM register operand operates as follows: 
* Data is loaded into bits 127:0 of the register 

° Bits above bit 127 in the register are cleared. 


Thus, such an instruction clears bits 255:128 of a destination YMM register on processors with a maximum vector- 
register width of 256 bits. In the event that future processors extend the vector registers to greater widths, an 
instruction encoded with a VEX.128 or VEX.256 prefix will also clear any bits beyond bit 255. (This is in contrast 
with legacy SSE instructions, which have no VEX prefix; these modify only bits 127:0 of any destination register 
operand.) 


Programmers should bear in mind that instructions encoded with VEX.128 and VEX.256 prefixes will clear any 
future extensions to the vector registers. A calling function that uses such extensions should save their state before 
calling legacy functions. This is not possible for involuntary calls (e.g., into an interrupt-service routine). It is 
recommended that software handling involuntary calls accommodate this by not executing instructions encoded 
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with VEX.128 and VEX.256 prefixes. In the event that it is not possible or desirable to restrict these instructions, 
then software must take special care to avoid actions that would, on future processors, zero the upper bits of vector 
registers. 


Processors that support further vector-register extensions (defining bits beyond bit 255) will also extend the 
XSAVE and XRSTOR instructions to save and restore these extensions. To ensure forward compatibility, software 
that handles involuntary calls and that uses instructions encoded with VEX.128 and VEX.256 prefixes should first 
save and then restore the vector registers (with any extensions) using the XSAVE and XRSTOR instructions with 
save/restore masks that set bits that correspond to all vector-register extensions. Ideally, software should rely on 
a mechanism that is cognizant of which bits to set. (E.g., an OS mechanism that sets the save/restore mask bits 
for all vector-register extensions that are enabled in XCRO.) Saving and restoring state with instructions other than 
XSAVE and XRSTOR will, on future processors with wider vector registers, corrupt the extended state of the vector 
registers - even if doing so functions correctly on processors supporting 256-bit vector registers. (The same is true 
if XSAVE and XRSTOR are used with a save/restore mask that does not set bits corresponding to all supported 
extensions to the vector registers. ) 


2.3.11 — Intel® AVX Instruction Length 


The Intel AVX instructions described in this document (including VEX and ignoring other prefixes) do not exceed 11 
bytes in length, but may increase in the future. The maximum length of an Intel 64 and IA-32 instruction remains 
15 bytes. 


2.3.12 Vector SIB (VSIB) Memory Addressing 


In Intel® Advanced Vector Extensions 2 (Intel® AVX2), an SIB byte that follows the ModR/M byte can support VSIB 
memory addressing to an array of linear addresses. VSIB addressing is only supported in a subset of Intel AVX2 
instructions. VSIB memory addressing requires 32-bit or 64-bit effective address. In 32-bit mode, VSIB addressing 
is not supported when address size attribute is overridden to 16 bits. In 16-bit protected mode, VSIB memory 
addressing is permitted if address size attribute is overridden to 32 bits. Additionally, VSIB memory addressing is 
supported only with VEX prefix. 


In VSIB memory addressing, the SIB byte consists of: 

¢ The scale field (bit 7:6) specifies the scale factor. 

° The index field (bits 5:3) specifies the register number of the vector index register, each element in the vector 
register specifies an index. 

° The base field (bits 2:0) specifies the register number of the base register. 


Table 2-13 shows the 32-bit VSIB addressing form. It is organized to give 256 possible values of the SIB byte (in 
hexadecimal). General purpose registers used as a base are indicated across the top of the table, along with corre- 
sponding values for the SIB byte’s base field. The register names also include R8D-R15D applicable only in 64-bit 
mode (when address size override prefix is used, but the value of VEX.B is not shown in Table 2-13). In 32-bit 
mode, R8D-R15D does not apply. 


Table rows in the body of the table indicate the vector index register used as the index field and each supported 
scaling factor shown separately. Vector registers used in the index field can be XMM or YMM registers. The left- 
most column includes vector registers VR8-VR15 (i.e., XMM8/YMM8-XMM15/YMM15), which are only available in 
64-bit mode and does not apply if encoding in 32-bit mode. 
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Table 2-13. 32-Bit VSIB Addressing Forms of the SIB Byte 


r32 EDX/ EBX/ ESP/ EBP/ 
R10D R11D R12D R13D! 
(In decimal) Base = 2 3 4 5 


1 
(In binary) Base = 010 011 100 101 


Scaled Index Value of SIB Byte (in Hexadecimal) 


VRO/VR8 

VR1/VR9 

VR2/VR10 
VR3/VR11 
VR4/VR12 
VR5/VR13 
VR6/VR14 
VR7/VR15 


VR1/VR9 
VR2/VR10 


NOTES: 
1. If ModR/M.mod = OOb, the base address is zero, then effective address is computed as [scaled vector index] + disp32. Otherwise the 
base address is computed as [EBP/R13]+ disp, the displacement is either 8 bit or 32 bit depending on the value of ModR/M.mod: 
MOD Effective Address 


O00b [Scaled Vector Register] + Disp32 
01b [Scaled Vector Register] + Disp8 + [EBP/R13] 
10b [Scaled Vector Register] + Disp32 + [EBP/R13] 


2.3.12.1 64-bit Mode VSIB Memory Addressing 


In 64-bit mode VSIB memory addressing uses the VEX.B field and the base field of the SIB byte to encode one of 
the 16 general-purpose register as the base register. The VEX.X field and the index field of the SIB byte encode one 
of the 16 vector registers as the vector index register. 


In 64-bit mode the top row of Table 2-13 base register should be interpreted as the full 64-bit of each register. 


2.4 INTEL® ADVANCED MATRIX EXTENSIONS (INTEL® AMX) 


Intel® AMX instructions follow the general documentation convention established in previous sections. Additionally, 
Intel® Advanced Matrix Extensions use notation conventions as described below. 


In the instruction encoding boxes, sibmem is used to denote an encoding where a ModR/M byte and SIB byte are 
used to indicate a memory operation where the base and displacement are used to point to memory, and the index 
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register (if present) is used to denote a stride between memory rows. The index register is scaled by the sib.scale 
field as usual. The base register is added to the displacement, if present. 


In the instruction encoding, the ModR/M byte is represented several ways depending on the role it plays. The 
ModR/M byte has 3 fields: 2-bit ModR/M.mod field, a 3-bit ModR/M.reg field and a 3-bit ModR/M.r/m field. When all 
bits of the ModR/M byte have fixed values for an instruction, the 2-hex nibble value of that byte is presented after 
the opcode in the encoding boxes on the instruction description pages. When only some fields of the ModR/M byte 
must contain fixed values, those values are specified as follows: 


¢ If only the ModR/M.mod must be 0b11, and ModR/M.reg and ModR/M.r/m fields are unrestricted, this is 
denoted as 11:rrr:bbb. The rrr correspond to the 3-bits of the ModR/M.reg field and the bbb correspond to the 
3-bits of the ModR/M.r/m field. 


¢ If the ModR/M.mod field is constrained to be a value other than 0b11, i.e., it must be one of Ob00, 0b01, or 
Ob10, then the notation !(11) is used. 


e If the ModR/M.reg field had a specific required value, e.g., 0b101, that would be denoted as mm:101:bbb. 


NOTE 


Historically this document only specified the ModR/M.reg field restrictions with the notation /0... /7 
and did not specify restrictions on the ModR/M.mod and ModR/M.r/m fields in the encoding boxes. 


2.5 INTEL® AVX AND INTEL® SSE INSTRUCTION EXCEPTION CLASSIFICATION 


To look up the exceptions of legacy 128-bit SIMD instruction, 128-bit VEX-encoded instructions, and 256-bit VEX- 
encoded instruction, Table 2-14 summarizes the exception behavior into separate classes, with detailed exception 
conditions defined in sub-sections 2.5.1 through 2.6.1. For example, ADDPS contains the entry: 


“See Exceptions Type 2” 
In this entry, "Type2” can be looked up in Table 2-14. 


The instruction’s corresponding CPUID feature flag can be identified in the fourth column of the Instruction 
summary table. 

Note: #UD on CPUID feature flags=0 is not guaranteed in a virtualized environment if the hardware supports the 
feature flag. 


NOTE 


Instructions that operate only with MMX, X87, or general-purpose registers are not covered by the 
exception classes defined in this section. For instructions that operate on MMX registers, see 
Section 23.25.3, “Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers” 
in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 
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Exception Class 


Instruction set 


Mem arg 


Floating-Point 


Exceptions (#XM) 
AVX, 16/32 byte explicitly 
Type: Legacy SSE aligned None 
AVX, 16/32 byte not explicitly 
ae S Legacy SSE aligned ae 
AVX, 
Type 3 Legacy SSE < 16 byte Yes 
AVX, 16/32 byte not explicitly 
Tape Legacy SSE aligned Me 
AVX, 
Type 5 Legacy SSE < 16 byte No 
Type 6 AVX (no Legacy SSE) Varies (At present, none do) 
AVX, 
Type 7 Legacy SSE None None 
Type 8 AVX None None 
F16C 8 or 16 byte, Not explicitly Yes 
iiype tl aligned, no AC# 
Type 12 AVX2 Gathers Not explicitly aligned, no No 


AC# 


See Table 2-15 for lists of instructions in each exception class. 
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Table 2-15. Instructions in each Exception Class 


Exception Class 


Instruction 


Type 1 


(V)MOVAPD, (V)MOVAPS, (V)MOVDOA, (V)MOVNTDO, (V)MOVNTDOA, (V)MOVNTPD, (V)MOVNTPS 


Type 2 


(V)ADDPD, (V)ADDPS, (V)ADDSUBPD, (V)ADDSUBPS, (V)CMPPD, (V)CMPPS, (V)CVTDQ2PS, (V)CVTPD2DQ, 
(V)CVTPD2PS, (V)CVTPS2DQ, (V)CVTTPD2DQ, (V)CVTTPS2DQ, (V)DIVPD, (V)DIVPS, (V)DPPD*, (V)DPPS*, 
VFMADD132PD, VFMADD213PD, VFMADD231PD, VFMADD132PS, VFMADD213PS, VFMADD231PS, 
VEMADDSUB132PD, VFMADDSUB213PD, VFMADDSUB231PD, VFMADDSUB132PS, VFMADDSUB213PS, 
VEMADDSUB231PS, VFMSUBADD132PD, VFMSUBADD213PD, VFMSUBADD231PD, VFMSUBADD132PS, 
VFMSUBADD213PS, VFMSUBADD231PS, VFMSUB132PD, VFMSUB213PD, VFMSUB231PD, VFMSUB132PS, 
VFMSUB213PS, VFMSUB231PS, VFNMADD132PD, VENMADD213PD, VFNMADD231PD, VFNMADD132PS, 
VENMADD213PS, VFNMADD231PS, VFNMSUB132PD, VFNMSUB213PD, VFNMSUB231PD, VFNMSUB132PS, 
VENMSUB213PS, VENMSUB231PS, (V)HADDPD, (V)HADDPS, (V)HSUBPD, (V)HSUBPS, (\V)MAXPD, (V)MAXPS, 
(V)MINPD, (V)MINPS, (V)MULPD, (V)MULPS, (V)ROUNDPD, (V)ROUNDPS, (V)SQRTPD, (V)SORTPS, (V)SUBPD, 
(V)SUBPS 


Type 3 


(V)ADDSD, (V)ADDSS, (V)CMPSD, (V)CMPSS, (V)COMISD, (V)COMISS, (V)CVTPS2PD, (V)CVTSD2SI, (V)CVTSD2SS, 
(V)CVTSI2SD, (V)CVTSI2SS, (V)CVTSS2SD, (V)CVTSS2SI, (V)CVTTSD2SI, (V)CVTTSS2SI, (V)DIVSD, (V)DIVSS, 
VFMADD132SD, VEMADD213SD, VFMADD231SD, VEMADD132SS, VFMADD213SS, VFMADD2315SS, 
VEMSUB132SD, VFMSUB213SD, VFMSUB231SD, VFMSUB132SS, VFMSUB213SS, VFMSUB2315SS, 
VENMADD132SD, VENMADD213SD, VENMADD231SD, VENMADD132SS, VFNMADD213SS, VFNMADD2315SS, 
VENMSUB132SD, VFNMSUB213SD, VFNMSUB231SD, VFNMSUB132SS, VFNMSUB213SS, VFNMSUB2315SS, 
(V)MAXSD, (V)MAXSS, (V)MINSD, (V)MINSS, (V)MULSD, (V)MULSS, (V)ROUNDSD, (V)ROUNDSS, (V)SORTSD, 


Type 4 


( 
(V)AESDEC, (V)AESDECLAST, (V)AESENC, (V)AESENCLAST, (V)AESIMC, (V)AESKEYGENASSIST, (V)ANDPD, 
(V)ANDPS, (V)ANDNPD, (V)ANDNPS, (V)BLENDPD, (V)BLENDPS, VBLENDVPD, VBLENDVPS, (V)LDDQU***, 
(V)MASKMOVDQU, (V)PTEST, VTESTPS, VTESTPD, (V)MOVDQU*, (V)MOVSHDUP, (V)MOVSLDUP, (V)MOVUPD*, 
(V)MOVUPS*, (V)MPSADBW, (V)ORPD, (V)ORPS, (V)PABSB, (V)PABSW, (V)PABSD, (V)PACKSSWB, (V)PACKSSDW, 
(V)PACKUSWB, (V)PACKUSDW, (V)PADDB, (V)PADDW, (V)PADDD, (\V)PADDQ, (V)PADDSB, (V)PADDSW, 
(V)PADDUSB, (V)PADDUSW, (V)PALIGNR, (V)PAND, (V)PANDN, (V)PAVGB, (V)PAVGW, (V)PBLENDVB, 
(V)PBLENDW, (V)PCMP(E/I)STRI/M***, (\V)PCMPEOQB, (\V)PCMPEQW, (V)PCMPEQD, (V)PCMPEQQ, (V)PCMPGTB, 
(V)PCMPGTW, (V)PCMPGTD, (V)PCMPGTQ, (V)PCLMULODQ, (V)PHADDW, (V)PHADDD, (V)PHADDSW, 
(V)PHMINPOSUW, (V)PHSUBD, (V)PHSUBW, (V)PHSUBSW, (V)PMADDWD, (V)PMADDUBSW, (V)PMAXSB, 
(V)PMAXSW, (V)PMAXSD, (V)PMAXUB, (V)PMAXUW, (V)PMAXUD, (V)PMINSB, (V)PMINSW, (V)PMINSD, 
(V)PMINUB, (V)PMINUW, (V)PMINUD, (V)PMULHUW, (V)PMULHRSW, (V)PMULHW, (V)PMULLW, (V)PMULLD, 
(V)PMULUDQ, (V)PMULDQ, (V)POR, (V)PSADBW, (V)PSHUEB, (V)PSHUFD, (V)PSHUFHW, (V)PSHUFLW, (V)PSIGNB, 
(V)PSIGNW, (V)PSIGND, (V)PSLLW, (V)PSLLD, (V)PSLLO, (V)PSRAW, (V)PSRAD, (V)PSRLW, (V)PSRLD, (V)PSRLQ, 
(V)PSUBB, (V)PSUBW, (\V)PSUBD, (\V)PSUBQ, (V)PSUBSB, (\V)PSUBSW, (V)PSUBUSB, (V)PSUBUSW, 
(V)PUNPCKHBW, (V)PUNPCKHWD, (V)PUNPCKHDQ, (V)PUNPCKHQDQ, (V)PUNPCKLBW, (V)PUNPCKLWD, 
(V)PUNPCKLDQ, (V)PUNPCKLQDQ, (V)PXOR, (V)RCPPS, (V)RSORTPS, (\V)SHUFPD, (V)SHUFPS, (VJUNPCKHPD, 
(V)UNPCKHPS, (V)UNPCKLPD, (V)UNPCKLPS, (V)XORPD, (V)XORPS, VPBLENDD, VPERMD, VPERMPS, VPERMPD, 
VPERMQ, VPSLLVD, VPSLLVQ, VPSRAVD, VPSRLVD, VPSRLVQ, VPERMILPD, VPERMILPS, VPERM2F128 


Type 5 


(V)CVTDQ2PD, (V)EXTRACTPS, (V)INSERTPS, (V)MOVD, (V)MOVO, (V)MOVDDUP, (V)MOVLPD, (V)MOVLPS, 
(V)MOVHPD, (V)MOVHPS, (V)MOVSD, (V)MOVSS, (V)PEXTRB, (V)PEXTRD, (V)PEXTRW, (V)PEXTRO, (V)PINSRB, 
(V)PINSRD, (V)PINSRW, (V)PINSRQ, PMOVSXBW, (V)RCPSS, (V)RSORTSS, (V)PMOVSX/ZX, VLDMXCSR*, 
VSTMXCSR 


Type 6 


VEXTRACTF128/VEXTRACTFxxxx, VBROADCASTSS, VBROADCASTSD, VBROADCASTF128, VINSERTF1 28, 
VMASKMOVPS**, VMASKMOVPD**, VPMASKMOVD, VPMASKMOVQ, VBROADCASTI128, VPBROADCASTB, 
VPBROADCASTD, VPBROADCASTW, VPBROADCASTQ, VEXTRACTI1 28, VINSERTI128, VPERM21128 


Type 7 


(V)MOVLHPS, (V)MOVHLPS, (V)MOVMSKPD, (V)MOVMSKPS, (V)PMOVMSKB, (V)PSLLDQ, (V)PSRLDQ, (V)PSLLW, 
(V)PSLLD, (V)PSLLO, (V)PSRAW, (V)PSRAD, (V)PSRLW, (V)PSRLD, (V)PSRLO 


Type 8 


VZEROALL, VZEROUPPER 


Type 11 


VCVTPH2PS, VCVTPS2PH 


Type 12 


VGATHERDPS, VGATHERDPD, VGATHEROPS, VGATHERQPD, VPGATHERDD, VPGATHERDQ, VPGATHERQD, 
VPGATHERQQ 


(*) - Additional exception restrictions are present - see the Instruction description for details 
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(**) - Instruction behavior on alignment check reporting with mask bits of less than all 1s are the same as with mask bits of all 1s, i.e, no 
alignment checks are performed. 


(***) - PCMPESTRI, PCMPESTRM, PCMPISTRI, PCMPISTRM, and LDDQU instructions do not cause #GP if the memory operand is not 
aligned to 16-Byte boundary. 


Table 2-15 classifies exception behaviors for AVX instructions. Within each class of exception conditions that are 
listed in Table 2-18 through Table 2-27, certain subsets of AVX instructions may be subject to #UD exception 
depending on the encoded value of the VEX.L field. Table 2-17 provides supplemental information of AVX instruc- 
tions that may be subject to #UD exception if encoded with incorrect values in the VEX.W or VEX.L field. 


Table 2-16. #UD Exception and VEX.W=1 Encoding 


Exception Class #UD If VEX.W = 1 in all modes #UD If VEX.W = 1 in 
non-64-bit modes 


Type 1 

Type 2 

Type 3 

Type 4 VBLENDVPD, VBLENDVPS, VPBLENDVB, VTESTPD, VTESTPS, VPBLENDD, VPERMD, 
VPERMPS, VPERM21128, VPSRAVD, VPERMILPD, VPERMILPS, VPERM2F128 

Type 5 


VEXTRACTF128, VBROADCASTSS, VBROADCASTSD, VBROADCASTF1 28, 
Type 6 VINSERTF128, VMASKMOVPS, VMASKMOVPD, VBROADCASTI128, 
VPBROADCASTB/W/D, VEXTRACTI128, VINSERTI128 


Type 7 
Type 8 
Type 11 VCVTPH2PS, VCVTPS2PH 
Type 12 
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Table 2-17. #UD Exception and VEX.L Field Encoding 


Exception 


#UD If (VEX.L = 1 && AVX2 not present && AVX 


#UD If (VEX.L = 1 && AVX2 


Class #UD If VEX.L = 0 present) present) 
Type 1 VMOVNTDQA 
Type 2 VDPPD VDPPD 
Type 3 
VMASKMOVDQU, VMPSADBW, VPABSB/W/D, VPCMP(E/I)STRIM, 
VPACKSSWB/DW, VPACKUSWB/DW, VPADDB/W/D, PHMINPOSUW 
VPADDQ, VPADDSB/W, VPADDUSB/W, VPALIGNR, VPAND, 
VPANDN, VPAVGB/W, VPBLENDVB, VPBLENDW, 
VPCMP(E/IJSTRI/M, VPCMPEQB/W/D/Q, VPCMPGTB/W/D/Q, 
VPHADDW/D, VPHADDSW, VPHMINPOSUW, VPHSUBD/W, 
uaa VPHSUBSW, VPMADDWD, VPMADDUBSW, VPMAXSB/W/D, 
yP VPMAXUB/W/D, VPMINSB/W/D, VPMINUB/W/D, 
VPMULHUW, VPMULHRSW, VPMULHW/LW, VPMULLD, 
VPMULUDQ, VPMULDQ, VPOR, VPSADBW, VPSHUFB/D, 
VPSHUFHW/LW, VPSIGNB/W/D, VPSLLW/D/Q, VPSRAW/D, 
VPSRLW/D/Q, VPSUBB/W/D/Q, VPSUBSB/W, 
VPUNPCKHBW/WD/DQ, VPUNPCKHQDQ, 
VPUNPCKLBW/WD/DQ, VPUNPCKLQDQ, VPXOR 
VEXTRACTPS, VINSERTPS, VMOVD, VMOVQ, VMOVLPD, Same as column 3 
apa VMOVLPS, VMOVHPD, VMOVHPS, VPEXTRB, VPEXTRD, 
yp VPEXTRW, VPEXTRQ, VPINSRB, VPINSRD, VPINSRW, 
VPINSRQ, VPMOVSX/ZX, VLDMXCSR, VSTMXCSR 
VEXTRACTF128, 
VPERM2F128, 
Type6 | VBROADCASTSD, 
VBROADCASTF128, 
VINSERTF128, 
VMOVLHPS, VMOVHLPS, VPMOVMSKB, VPSLLDQ, VMOVLHPS, VMOVHLPS 
Type 7 VPSRLDQ, VPSLLW, VPSLLD, VPSLLQ, VPSRAW, VPSRAD, 
VPSRLW, VPSRLD, VPSRLO 
Type 8 
Type 11 
Type 12 
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2.5.1 Exceptions Type 1 (Aligned Memory Reference) 


Table 2-18. Type 1 Class Exception Conditions 


Exception 


Real 


Protected and 
Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, 
#UD 


x< 


><) Virtual-8086 


VEX prefix. 


VEX prefix: 
If XCRO[2:1] ?‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 


Legacy SSE instruction: 
If CRO.EM[bit 2] = 1. 
If CR4.0SFXSR[bit 9] = 0. 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Avail- 
able, #NM 


>< | KK) ><) X< 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


<| >< =| | ><) X< 


For an illegal address in the SS segment. 


If a memory address referencing the SS segment is in a non-canonical form. 


General Protec- 
tion, #GP(0) 


VEX.256: Memory operand is not 32-byte aligned. 
VEX.128: Memory operand is not 16-byte aligned. 


Legacy SSE: Memory operand is not 16-byte aligned. 


For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 


If the memory address is in a non-canonical form. 


If any part of the operand lies outside the effective address space from O to FFFFH. 


Page Fault 
#PF(fault-code) 


For a page fault. 
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2.5.2 Exceptions Type 2 (>=16 Byte Memory Reference, Unaligned) 
Table 2-19. Type 2 Class Exception Conditions 
g |sz 
Exception g © 3 = 5 Cause of Exception 
5 |Es 
X X VEX prefix. 
X X X X | Ifanunmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 0. 
VEX prefix: 
X X | If XCRO[2:1] ? ‘11b’. 
; If CR4.0SXSAVE[bit 18]=0. 
Invalid Opcode, : 7 
#UD Legacy SSE instruction: 
X X X X | If CRO.EM[bit 2] = 1. 
If CR4.0SFXSR[bit 9] = 0. 
X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
Device Not Avail- es 
able, #NM X X X X | If CRO.TS[bit 3]=1. 
X For an illegal address in the SS segment. 
Stack, #SS(0) : — : 
X | Ilfamemory address referencing the SS segment is in a non-canonical form. 
X X X X | Legacy SSE: Memory operand is not 16-byte aligned. 
General Protec- X For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
tion, #GP(0) X | If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to FFFFH. 
Page Fault 
#PF(fault-code) X X X | For a page fault. 
SIMD Floating- 
point Exception, X X X X | Ifan unmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 1. 


#XM 
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2.3.5 Exceptions Type 3 (<16 Byte Memory Argument) 


Table 2-20. Type 3 Class Exception Conditions 


g Be 
_ & |\vs/# 
Exception os fh a Cause of Exception 
=|2 |ge|¢ 
Ss es 
X X VEX prefix. 
X X X X | If anunmasked SIMD floating-point exception and CR4.0SXMMEXCPT|bit 10] = O. 
VEX prefix: 


X X | If XCRO[2:1] ?‘11b’. 

If CR4.0SXSAVE[bit 18]=0. 
Invalid Opcode, #UD Legacy SSE instruction: 

X X X X | If CRO.EM[bit 2] = 1. 

If CR4.0SFXSR[bit 9] = 0. 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
DeviceNotAvallable, | yx | x | x | x | lfcROTSpbit 3]=1. 
#NM 
X For an illegal address in the SS segment. 
Stack, #SS(0) : = : 
X | Ifamemory address referencing the SS segment is in a non-canonical form. 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 
pari Posie X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from 0 to 
X X 
FFFFH. 
Page Fault 


#PF(fault-code) X X X | Fora page fault. 


Alignment Check For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 


SIMD Floating-point 


Exception, #XM X X X X_| If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT\[bit 10] = 1. 
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2.5.4 Exceptions Type 4 (>=16 Byte Mem Arg, No Alignment, No Floating-point Exceptions) 


Table 2-21. Type 4 Class Exception Conditions 


8 Ee 
— & \vaiz 
Exception o|4 |#8 + Cause of Exception 
(a 5 o2|\6 
EB ls§ 
S |ES 
X X VEX prefix. 
VEX prefix: 


X X | If XCRO[2:1] ? ‘11b’. 

If CR4.0SXSAVE[bit 18]=0. 
Legacy SSE instruction: 

X X X X | If CRO.EM[bit 2] = 1. 

If CR4.0SFXSR[bit 9] = 0. 


Invalid Opcode, #UD 


X X X X | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘0’. 
a NotAvallable, | x | x | x | x | ifcROTS[bit 3]=1, 
X For an illegal address in the SS segment. 


Stack, #SS(0 , sd : 
(0) X | Ilfamemory address referencing the SS segment is in a non-canonical form. 


xX X X X | Legacy SSE: Memory operand is not 16-byte aligned. ! 


X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, ments. 
#GP(0) X | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from 0 to 
X X 
FFFFH. 
Page Fault 
#PF(fault-code) X X X | Fora page fault. 
NOTES: 


1. LDDQU, MOVUPD, MOVUPS, PCMPESTRI, PCMPESTRM, PCMPISTRI, and PCMPISTRM instructions do not cause #GP if the memory 
operand is not aligned to 16-Byte boundary. 
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2.5.5 Exceptions Type 5 (<16 Byte Mem Arg and No FP Exceptions) 


Table 2-22. Type 5 Class Exception Conditions 


g Ee 
=_ 8 eal # 
Exception o/4 |\f% + Cause of Exception 
~'2 826 
5s |ES 
X X VEX prefix. 
VEX prefix: 
X X | If XCRO[2:1] ?‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 
; Legacy SSE instruction: 
Invalid Opcode, #UD | y | y | yx | x | IfCROEMpbit 2)=1. 
If CR4.0SFXSRI[bit 9] = 0. 
Xx X X X_ | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X_| If any corresponding CPUID feature flag is ‘0’. 
Device Nat rvallaten | 9c) 3¢ |) 9¢"] 3e: | SPCROMSIBIE TET. 
#NM 
Stack, #55(0) X For an illegal address in the SS segment. 
‘ X | Ifamemory address referencing the SS segment is in a non-canonical form. 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
: ments. 
at Protectan, X_ | If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault 
#PF(fault-code) X X X | Fora page fault. 
Alignment Check Xx X x For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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2.5.6 


Exceptions Type 6 (VEX-Encoded Instructions without Legacy SSE Analogues) 


Note: At present, the AVX instructions in this category do not generate floating-point exceptions. 


Table 2-23. Type 6 Class Exception Conditions 


a=) 
B Sf 
= s u7O/# 
Exception os 2s zy Cause of Exception 
=“ 2 826 
— oer} 
> lav 
X X VEX prefix. 
X X If XCRO[2:1] ? ‘11b’. 
acsiaeealin If CR4.0SXSAVE[bit 18]=0. 
ia acta X | X | Ifpreceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, am 
#NM X X | If CRO.TS[bit 3]=1. 
Stack, #S5(0) X For an illegal address in the SS segment. 
‘ X | Ifamemory address referencing the SS segment is in a non-canonical form. 
. For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, X anenté 
#GP(O : 
(0) X | If the memory address is in a non-canonical form. 
Page Fault 
#PF(fault-code) X X | Fora page fault. 
Alignment Check X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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re WE | Exceptions Type 7 (No FP Exceptions, No Memory Arg) 


Table 2-24. Type 7 Class Exception Conditions 


g Ez 
_ & \vaiz 
Exception o/4 |\f% + Cause of Exception 
a 5 o2|\@ 
EB \s§ 
S ES 
X X VEX prefix. 
VEX prefix: 


X X | If XCRO[2:1] ?‘11b’. 

If CR4.0SXSAVE[bit 18]=0. 
Legacy SSE instruction: 

X X X X | If CRO.EM[bit 2] = 1. 

If CR4.0SFXSR[bit 9] = 0. 


Invalid Opcode, #UD 


X X X X_ | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X | If any corresponding CPUID feature flag is ‘O’. 
Device Not Available, X Xx | Hf CRO.TS[bit 3]=1. 


#NM 


2.5.8 Exceptions Type 8 (AVX and No Memory Argument) 


Table 2-25. Type 8 Class Exception Conditions 


8 |Ee 
= & |\vaiz# 
Exception o|4 |/£% + Cause of Exception 
~ Ss ijaalg 
Ess 
Ss ES 
Invalid Opcode, HUD | X X Always in Real or Virtual-8086 mode. 


x< 
x< 


If XCRO[2:1] ?‘11b’. 

If CR4.0SXSAVE[bit 18]=0. 

If CPUID.01H.ECX.AVX[bit 28]=0. 
If VEX.vvvv ? 11118. 


X X X X If proceeded by a LOCK prefix (FOH). 


Device Not Available, X X If CRO.TS[bit 3]=1. 
#NM 
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2.5.9 Exceptions Type 11 (VEX-only, Mem Arg, No AC, Floating-point Exceptions) 


Table 2-26. Type 11 Class Exception Conditions 


Exception, #XM 


o 2p 
o |S 
Excepti B 2 BES Cause of Excepti 
Xception 2g a 5 0 + ause of Exception 
E Ss 
Ss |£8 
Invalid Opcode, HUD | X X VEX prefix. 
Xx X VEX prefix: 
If XCRO[2:1] ?‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X X If any corresponding CPUID feature flag is ‘0’. 
Device Not Avail- X X X X If CRO.TS[bit 3]=1. 
able, #NM 
Stack, #SS(0) X For an illegal address in the SS segment. 
X If amemory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from 0 to 
FFFFH. 
Page Fault #PF X X X For a page fault. 
(fault-code) 
SIMD Floating-Point X X X X If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 1. 
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2.5.10 Exceptions Type 12 (VEX-only, VSIB Mem Arg, No AC, No Floating-point Exceptions) 


Table 2-27. Type 12 Class Exception Conditions 


~0 
8/52 
_ S |\va|/ # 
. oO T ops; 2 i 
Exception o os |S] yg Cause of Exception 
a $3 |22/35 
BE /Seg 
> |av 
Invalid Opcode, HUD | X X VEX prefix. 
X X VEX prefix: 
If XCRO[2:1] ?‘11b’. 
If CR4.0SXSAVE[bit 18]=0. 
X X X Xx If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X NA | If address size attribute is 16 bit. 
X X X X If ModR/M.mod = ‘11b’. 
x x X x If ModR/M.rm ? ‘100b’. 
X X X X If any corresponding CPUID feature flag is ‘0’. 
X X X X If any vector register is used more than once between the destination register, 


mask register and the index register in VSIB addressing. 
Device Not Available, | X X X X If CRO.TS[bit 3]=1. 


#NM 
Stack, #SS(0) X For an illegal address in the SS segment. 

X If a memory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 

X If the memory address is in a non-canonical form. 

X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 

Page Fault #PF (fault- X X X For a page fault. 
code) 


2.6 VEX ENCODING SUPPORT FOR GPR INSTRUCTIONS 


VEX prefix may be used to encode instructions that operate on neither YMM nor XMM registers. VEX-encoded 
general-purpose-register instructions have the following properties: 


¢ Instruction syntax support for three encodable operands. 


¢ Encoding support for instruction syntax of non-destructive source operand, destination operand encoded via 
VEX.vvvv, and destructive three-operand syntax. 


¢ Elimination of escape opcode byte (OFH), two-byte escape via a compact bit field representation within the VEX 
prefix. 


¢° Elimination of the need to use REX prefix to encode the extended half of general-purpose register sets (R8- 
R15) for direct register access or memory addressing. 


¢ Flexible and more compact bit fields are provided in the VEX prefix to retain the full functionality provided by 
REX prefix. REX.W, REX.X, REX.B functionalities are provided in the three-byte VEX prefix only. 


e VEX-encoded GPR instructions are encoded with VEX.L=0. 
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Any VEX-encoded GPR instruction with a 66H, F2H, or F3H prefix preceding VEX will #UD. 
Any VEX-encoded GPR instruction with a REX prefix proceeding VEX will #UD. 
VEX-encoded GPR instructions are not supported in real and virtual 8086 modes. 


2.6.1 Exceptions Type 13 (VEX-Encoded GPR Instructions) 


The exception conditions applicable to VEX-encoded GPR instruction differs from those of legacy GPR instructions. 
Table 2-28 lists VEX-encoded GPR instructions. The exception conditions for VEX-encoded GRP instructions are 
found in Table 2-29 for those instructions which have a default operand size of 32 bits and 16-bit operand size is 
not encodable. 


Table 2-28. VEX-Encoded GPR Instructions 


Exception Class Instruction 


Type 13 ANDN, BEXTR, BLSI, BLSMSK, BLSR, BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX 


(*) - Additional exception restrictions are present - see the Instruction description for details. 


Table 2-29. Type 13 Class Exception Conditions 


a=) 
2/52 
a & |v.) # 
. oO T eos; 2 H 
Exception @ ws /Sely Cause of Exception 
ra Sijaolg 
EB \|o§g 
> |av 
Invalid Opcode, HUD | X X X X If BMI1/BMl2 CPUID feature flag is ‘0’. 
X X If a VEX prefix is present. 
X X X X If VEX.L = 1. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
Stack, #SS(0) X X X For an illegal address in the SS segment. 
X If a memory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null 
segment selector. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF(fault- X X X For a page fault. 
code) 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 


2.7 INTEL® AVX-512 ENCODING 


The majority of the Intel AVX-512 family of instructions (operating on 512/256/128-bit vector register operands) 
are encoded using a new prefix (called EVEX). Opmask instructions (operating on opmask register operands) are 
encoded using the VEX prefix. The EVEX prefix has some parts resembling the instruction encoding scheme using 
the VEX prefix, and many other capabilities not available with the VEX prefix. 
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The significant feature differences between EVEX and VEX are summarized below. 


EVEX is a 4-Byte prefix (the first byte must be 62H); VEX is either a 2-Byte (C5H is the first byte) or 3-Byte 
(CAH is the first byte) prefix. 


EVEX prefix can encode 32 vector registers (KXMM/YMM/ZMM) in 64-bit mode. 


EVEX prefix can encode an opmask register for conditional processing or selection control in EVEX-encoded 
vector instructions. Opmask instructions, whose source/destination operands are opmask registers and treat 
the content of an opmask register as a single value, are encoded using the VEX prefix. 


EVEX memory addressing with disp8 form uses a compressed disp8 encoding scheme to improve the encoding 
density of the instruction byte stream. 


EVEX prefix can encode functionality that are specific to instruction classes (e.g., packed instruction with 
“load+op” semantic can support embedded broadcast functionality, floating-point instruction with rounding 
semantic can support static rounding functionality, floating-point instruction with non-rounding arithmetic 
semantic can support “suppress all exceptions” functionality). 


2.7.1 Instruction Format and EVEX 


The placement of the EVEX prefix in an IA instruction is represented in Figure 2-10. Note that the values contained 
within brackets are optional. 


# of bytes: 4 1 1 1 2,4 1 
[Prefixes] EVEX Opcode ModR/M [SIB] [Disp16,32] [Immediate] 
1 
[Disp8*N] 


Figure 2-10. Intel® AVX-512 Instruction Format and the EVEX Prefix 


The EVEX prefix is a 4-byte prefix, with the first two bytes derived from unused encoding form of the 32-bit-mode- 
only BOUND instruction. The layout of the EVEX prefix is shown in Figure 2-11. The first byte must be 62H, followed 
by three payload bytes, denoted as PO, P1, and P2 individually or collectively as P[23:0] (see Figure 2-11). 


EVEX 62H PO P1 P2 
7 6 5 4 3 2 1 0 
PO R x B R’ 0 m m m P[7:0] 
7 6 5 4 2 2 q 0 
P1 WwW Vv v v Vv 1 p p P[15:8] 
7 6 5 4 2 2 1 0 
P2 z v L b Vv’ a a a P[23:16] 


Figure 2-11. Bit Field Layout of the EVEX Prefix! 


NOTES: 
1. See Table 2-30 for additional details on bit fields. 
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Table 2-30. EVEX Prefix Bit Field Functional Grouping 


Notation Bit field Group Position Comment 

EVEX.mmm Access to up to eight decoding maps P[2:0] Currently, only the following decoding maps are supported: 1, 
2, 3, 5,and 6. 

-- Reserved P[3] Must be 0. 

EVEX.R’ High-16 register specifier modifier P[4] Combine with EVEX.R and ModR/M.reg. This bit is stored in 
inverted format. 

EVEX.RXB Next-8 register specifier modifier P[7:5] Combine with ModR/M.reg, ModR/M.rm (base, index/vidx). This 
field is encoded in bit inverted format. 

EVEX.X High-16 register specifier modifier P[6] Combine with EVEX.B and ModR/M.rm, when SIB/VSIB absent. 

EVEX.pp Compressed legacy prefix P[9:8] Identical to VEX.pp. 

-- Fixed Value P[10] Must be 1. 

EVEX.vvvv VVVV register specifier P[14:11] Same as VEX.vvvv. This field is encoded in bit inverted format. 

EVEX.W Operand size promotion/Opcode P[15] 

extension 

EVEX.aaa Embedded opmask register specifier P[18:16] 

EVEX.V’ High-16 VVVV/VIDX register specifier | P[19] Combine with EVEX.vvvv or when VSIB present. This bit is 
stored in inverted format. 

EVEX.b Broadcast/RC/SAE Context P[20] 

EVEX.UL Vector length/RC P[22:21] 

EVEX.z Zeroing/Merging P[23] 


The bit fields in P[23:0] are divided into the following functional groups (Table 2-30 provides a tabular summary): 


Reserved bits: P[3] must be 0, otherwise #UD. 
Fixed-value bit: P[10] must be 1, otherwise #UD. 


Compressed legacy prefix/escape bytes: P[1:0] is identical to the lowest 2 bits of VEX.mmmmm,; P[9:8] is 
identical to VEX.pp. 


EVEX.mmm: P[2:0] provides access to up to eight decoding maps. Currently, only the following decoding maps 
are supported: 1, 2, 3, 5, and 6. Map ids 1, 2, and 3 are denoted by OF, OF38, and OF3A, respectively, in the 
instruction encoding descriptions. 


Operand specifier modifier bits for vector register, general purpose register, memory addressing: P[7:5] allows 
access to the next set of 8 registers beyond the low 8 registers when combined with ModR/M register specifiers. 


Operand specifier modifier bit for vector register: P[4] (or EVEX.R’) allows access to the high 16 vector register 
set when combined with P[7] and ModR/M.reg specifier; P[6] can also provide access to a high 16 vector 
register when SIB or VSIB addressing are not needed. 


Non-destructive source /vector index operand specifier: P[19] and P[14:11] encode the second source vector 
register operand in a non-destructive source syntax, vector index register operand can access an upper 16 
vector register using P[19]. 


Op-mask register specifiers: P[18:16] encodes op-mask register set kO-k7 in instructions operating on vector 
registers. 


EVEX.W: P[15] is similar to VEX.W which serves either as opcode extension bit or operand size promotion to 
64-bit in 64-bit mode. 


Vector destination merging/zeroing: P[23] encodes the destination result behavior which either zeroes the 
masked elements or leave masked element unchanged. 


Broadcast/Static-rounding/SAE context bit: P[20] encodes multiple functionality, which differs across different 
classes of instructions and can affect the meaning of the remaining field (EVEX.L’L). The functionality for the 
following instruction classes are: 
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— Broadcasting a single element across the destination vector register: this applies to the instruction class 
with Load+Op semantic where one of the source operand is from memory. 


— Redirect L’L field (P[22:21]) as static rounding control for floating-point instructions with rounding 
semantic. Static rounding control overrides MXCSR.RC field and implies “Suppress all exceptions” (SAE). 


— Enable SAE for floating -point instructions with arithmetic semantic that is not rounding. 


— For instruction classes outside of the afore-mentioned three classes, setting EVEX.b will cause #UD. 


¢ Vector length/rounding control specifier: P[22:21] can serve one of three options. 


— Vector length information for packed vector instructions. 


— Ignored for instructions operating on vector register content as a single data element. 


— Rounding control for floating-point instructions that have a rounding semantic and whose source and 
destination operands are all vector registers. 


2.7.2 


Register Specifier Encoding and EVEX 


EVEX-encoded instruction can access 8 opmask registers, 16 general-purpose registers and 32 vector registers in 
64-bit mode (8 general-purpose registers and 8 vector registers in non-64-bit modes). EVEX-encoding can support 
instruction syntax that access up to 4 instruction operands. Normal memory addressing modes and VSIB memory 
addressing are supported with EVEX prefix encoding. The mapping of register operands used by various instruction 
syntax and memory addressing in 64-bit mode are shown in Table 2-31. Opmask register encoding is described in 


Section 2.7.3. 
Table 2-31. 32-Register Support in 64-bit Mode Using EVEX with Embedded REX Bits 
4) 3 [2:0] Reg. Type Common Usages 
REG EVEX.R’ REX.R modrm.reg GPR, Vector Destination or Source 
VVVV EVEX.V’ EVEX.vvvv GPR, Vector 2ndSource or Destination 
RM EVEX.X EVEX.B modrm.r/m GPR, Vector 1st Source or Destination 
BASE 0 EVEX.B modrm.r/m GPR memory addressing 
INDEX 0 EVEX.X sib.index GPR memory addressing 
VIDX EVEX.V' EVEX.X sib.index Vector VSIB memory addressing 
NOTES: 


1. Not applicable for accessing general purpose registers. 


The mapping of register operands used by various instruction syntax and memory addressing in 32-bit modes are 


shown in Table 2-32. 


Table 2-32. EVEX Encoding Register Specifiers in 32-bit Mode 


[2:0] Reg. Type Common Usages 
REG modrm.reg GPR, Vector Destination or Source 
VVVV EVEX.vvv GPR, Vector 2nd Source or Destination 
RM modrm.r/m GPR, Vector 1st Source or Destination 
BASE modrm.r/m GPR Memory Addressing 
INDEX sib.index GPR Memory Addressing 
VIDX sib.index Vector VSIB Memory Addressing 
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21.3 Opmask Register Encoding 


There are eight opmask registers, kKO-k7. Opmask register encoding falls into two categories: 


Opmask registers that are the source or destination operands of an instruction treating the content of opmask 
register as a scalar value, are encoded using the VEX prefix scheme. It can support up to three operands using 
standard modR/M byte’s reg field and rm field and VEX.vvvv. Such a scalar opmask instruction does not support 
conditional update of the destination operand. 


An opmask register providing conditional processing and/or conditional update of the destination register of a 
vector instruction is encoded using EVEX.aaa field (see Section 2.7.4). 


An opmask register serving as the destination or source operand of a vector instruction is encoded using 
standard modR/M byte’s reg field and rm fields. 


Table 2-33. Opmask Register Specifier Encoding 


[2:0] Register Access Common Usages 
REG modrm.reg kO-k7 Source 
VVVV VEX.vvvv kO-k7 2nd Source 
RM modrm.r/m k0-7 Ist Source 
{k1} EVEX.aaa kO!-k7 Opmask 
NOTES: 


1. Instructions that overwrite the conditional mask in opmask do not permit using kO as the embedded mask. 


2.7.4 Masking Support in EVEX 


EVEX can encode an opmask register to conditionally control per-element computational operation and updating of 
result of an instruction to the destination operand. The predicate operand is known as the opmask register. The 
EVEX.aaa field, P[18:16] of the EVEX prefix, is used to encode one out of a set of eight 64-bit architectural regis- 
ters. Note that from this set of 8 architectural registers, only ki through k7 can be addressed as predicate oper- 
ands. kO can be used as a regular source or destination but cannot be encoded as a predicate operand. 


AVX-512 instructions support two types of masking with EVEX.z bit (P[23]) controlling the type of masking: 


Merging-masking, which is the default type of masking for EVEX-encoded vector instructions, preserves the old 
value of each element of the destination where the corresponding mask bit has a O. It corresponds to the case 
of EVEX.z = 0. 


Zeroing-masking, is enabled by having the EVEX.z bit set to 1. In this case, an element of the destination is set 
to 0 when the corresponding mask bit has a 0 value. 


AVX-512 Foundation instructions can be divided into the following groups: 


Instructions which support “zeroing-masking”. 

— Also allow merging-masking. 

Instructions which require aaa = O00. 

— Do not allow any form of masking. 

Instructions which allow merging-masking but do not allow zeroing-masking. 

— Require EVEX.z to be set to 0. 

— This group is mostly composed of instructions that write to memory. 

Instructions which require aaa <> 000 do not allow EVEX.z to be set to 1. 

— Allow merging-masking and do not allow zeroing-masking, e.g., gather instructions. 
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2.7.5 Compressed Displacement (disp8*N) Support in EVEX 


For memory addressing using disp8 form, EVEX-encoded instructions always use a compressed displacement 
scheme by multiplying disp8 in conjunction with a scaling factor N that is determined based on the vector length, 
the value of EVEX.b bit (embedded broadcast) and the input element size of the instruction. In general, the factor 
N corresponds to the number of bytes characterizing the internal memory operation of the input operand (e.g., 64 
when the accessing a full 512-bit memory vector). The scale factor N is listed in Table 2-34 and Table 2-35 below, 
where EVEX encoded instructions are classified using the tupletype attribute. The scale factor N of each tupletype 
is listed based on the vector length (VL) and other factors affecting it. 


Table 2-34 covers EVEX-encoded instructions which has a load semantic in conjunction with additional computa- 
tional or data element movement operation, operating either on the full vector or half vector (due to conversion of 
numerical precision from a wider format to narrower format). EVEX.b is supported for such instructions for data 
element sizes which are either dword or qword (see Section 2.7.11). 

EVEX-encoded instruction that are pure load/store, and “Load+op” instruction semantic that operate on data 
element size less then dword do not support broadcasting using EVEX.b. These are listed in Table 2-35. Table 2-35 
also includes many broadcast instructions which perform broadcast using a subset of data elements without using 
EVEX.b. These instructions and a few data element size conversion instruction are covered in Table 2-35. Instruc- 
tion classified in Table 2-35 do not use EVEX.b and EVEX.b must be O, otherwise #UD will occur. 

The tupletype will be referenced in the instruction operand encoding table in the reference page of each instruction, 
providing the cross reference for the scaling factor N to encoding memory addressing operand. 


Note that the disp8*N rules still apply when using 16b addressing. 


Table 2-34. Compressed Displacement (DISP8*N) Affected by Embedded Broadcast 


TupleType | EVEX.b | InputSize | EVEX.W | Broadcast | N (VL=128) | N(VL=256) | N(VL=512) Comment 
0 32bit 0 none 16 32 64 
1 32bit 0) {1 tox} 4 4 4 Load+Op (Full Vector 
Full - 
0) 64bit 1 none 16 32 64 Dword/Qword) 
1 64bit 1 {1tox} 8 8 8 
0 32bit 0 none 8 16 32 
Half Load+Op (Half Vector) 
1 32bit 0 {1tox} 4 4 4 


Table 2-35. EVEX DISP8*N for Instructions Not Affected by Embedded Broadcast 


TupleType InputSize | EVEX.W | N (VL= 128) | N (VL= 256) | N (VL= 512) Comment 
Full Mem N/A N/A 16 32 64 Load/store or subDword full vector 
8bit N/A 1 1 1 
16bit N/A 2 2 2 
Tuple1 Scalar 1Tuple 
32bit 0 4 4 4 
64bit 1 8 8 8 
32bit N/A 4 4 4 i 
Tuple1 Fixed 1 Tuple, memsize not affected by 
64bit N/A 8 8 8 EVEX.W 
32bit 0 8 8 8 
Tuple2 Broadcast (2 elements) 
64bit 1 NA 16 16 
32bit 0 NA 16 16 
Tuple4 Broadcast (4 elements) 
64bit 1 NA NA 32 
Tuple8 32bit 0 NA NA 32 Broadcast (8 elements) 
Half Mem N/A N/A 8 16 32 SubQword Conversion 
Quarter Mem N/A N/A 4 8 16 SubDword Conversion 
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Table 2-35. EVEX DISP8*N for Instructions Not Affected by Embedded Broadcast (Contd.) 


TupleType InputSize | EVEX.W | N (VL= 128) | N (VL= 256) | N (VL= 512) Comment 

Eighth Mem N/A N/A 2 4 8 SubWord Conversion 
Mem128 N/A N/A 16 16 16 Shift count from memory 
MOVDDUP N/A N/A 8 32 64 VMOVDDUP 


2.7.6 EVEX Encoding of Broadcast/Rounding/SAE Support 
EVEX.b can provide three types of encoding context, depending on the instruction classes: 


° Embedded broadcasting of one data element from a source memory operand to the destination for vector 
instructions with “load+op” semantic. 


¢ Static rounding control overriding MXCSR.RC for floating-point instructions with rounding semantic. 


¢ “Suppress All exceptions” (SAE) overriding MXCSR mask control for floating-point arithmetic instructions that 
do not have rounding semantic. 


cael BF Embedded Broadcast Support in EVEX 


EVEX encodes an embedded broadcast functionality that is supported on many vector instructions with 32-bit 
(double word or single precision floating-point) and 64-bit data elements, and when the source operand is from 
memory. EVEX.b (P[20]) bit is used to enable broadcast on load-op instructions. When enabled, only one element 
is loaded from memory and broadcasted to all other elements instead of loading the full memory size. 


The following instruction classes do not support embedded broadcasting: 

¢ Instructions with only one scalar result is written to the vector destination. 
¢ Instructions with explicit broadcast functionality provided by its opcode. 

¢ Instruction semantic is a pure load or a pure store operation. 


2.7.8 Static Rounding Support in EVEX 


Static rounding control embedded in the EVEX encoding system applies only to register-to-register flavor of 
floating-point instructions with rounding semantic at two distinct vector lengths: (i) scalar, (ii) 512-bit. In both 
cases, the field EVEX.L’L expresses rounding mode control overriding MXCSR.RC if EVEX.b is set. When EVEX.b is 
set, “suppress all exceptions” is implied. The processor behaves as if all MXCSR masking controls are set. 


2.7.9 SAE Support in EVEX 


The EVEX encoding system allows arithmetic floating-point instructions without rounding semantic to be encoded 
with the SAE attribute. This capability applies to scalar and 512-bit vector lengths, register-to-register only, by 
setting EVEX.b. When EVEX.b is set, “suppress all exceptions” is implied. The processor behaves as if all MKCSR 
masking controls are set. 


2.7.10 Vector Length Orthogonality 


The architecture of EVEX encoding scheme can support SIMD instructions operating at multiple vector lengths. 
Many AVX-512 Foundation instructions operate at 512-bit vector length. The vector length of EVEX encoded vector 
instructions are generally determined using the L’L field in EVEX prefix, except for 512-bit floating-point, reg-reg 
instructions with rounding semantic. The table below shows the vector length corresponding to various values of 
the L’L bits. When EVEX is used to encode scalar instructions, L’L is generally ignored. 

When EVE X.b bit is set for a register-register instructions with floating-point rounding semantic, the same two bits 
P2[6:5] specifies rounding mode for the instruction, with implied SAE behavior. The mapping of different instruc- 
tion classes relative to the embedded broadcast/rounding/SAE control and the EVEX.L’L fields are summarized in 
Table 2-36. 
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Table 2-36. EVEX Embedded Broadcast/Rounding/SAE and Vector Length on Vector Instructions 


Explicit Load/Store/Broadcast/Gather/Scatter) 


#UD) 


11b: Reserved (#UD) 


Position P2[4] P2[6:5] P2[6:5] 
Broadcast/Rounding/SAE Context EVEX.b EVEX.L'L EVEX.RC 
Reg-reg, FP Instructions w/ rounding semantic or SAE Enable static rounding Vector length Implied OOb: SAE + RNE 
control (SAE implied) (512 bit or scalar) 01b: SAE + RD 
10b: SAE + RU 
11b: SAE + RZ 
Load+op Instructions w/ memory source Broadcast Control OOb: 128-bit NA 
; ; 01b: 256-bit 
Other Instructions ( Must be 0 (otherwise 10b: 512-bit NA 


2.7.11 #UD Equations for EVEX 


Instructions encoded using EVEX can face three types of UD conditions: state dependent, opcode independent and 


opcode dependent. 


2.7.11.1 State Dependent #UD 


In general, attempts of execute an instruction, which required OS support for incremental extended state compo- 
nent, will #UD if required state components were not enabled by OS. Table 2-37 lists instruction categories with 
respect to required processor state components. Attempts to execute a given category of instructions while 
enabled states were less than the required bit vector in XCRO shown in Table 2-37 will cause #UD. 


Table 2-37. OS XSAVE Enabling Requirements of Instruction Categories 


Instruction Categories Vector Register State Access Required XCRO Bit Vector [7:0] 
Legacy SIMD prefix encoded Instructions (e.g SSE) XMM XXXXXX1 1b 
VEX-encoded instructions operating on YMM YMM XXXXX111b 
EVEX-encoded 128-bit instructions ZMM 111xx111b 
EVEX-encoded 256-bit instructions ZMM 111xx111b 
EVEX-encoded 512-bit instructions ZMM 111xx111b 
VEX-encoded instructions operating on opmask k-reg 111xxx11b 


2.7.11.2 Opcode Independent #UD 


A number of bit fields in EVEX encoded instruction must obey mode-specific but opcode-independent patterns 


listed in Table 2-38. 


Table 2-38. Opcode Independent, State Dependent EVEX Bit Fields 


Position Notation 64-bit #UD Non-64-bit #UD 
P[3] - if > 0 if > 0 
P[10] -- if O if O 
P[2:0] EVEX.mmm if O0Ob, 100b, or 111b if O0Ob, 100b, or 111b 
P[7 : 6] EVEX.RX None (valid) None (BOUND if EVEX.RX != 11b) 
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2.7.11.3. Opcode Dependent #UD 


This section describes legal values for the rest of the EVEX bit fields. Table 2-39 lists the #UD conditions of EVEX 
prefix bit fields which encodes or modifies register operands. 


Table 2-39. HUD Conditions of Operand-Encoding EVEX Prefix Bit Fields 


Notation Position Operand Encoding 64-bit HUD Non-64-bit #UD 
EVEX.R P[7] ModRM.reg encodes k-reg If EVEX.R = 0 None (BOUND if 
ModRM.reg is opcode extension None (ignored) EVEX.RX IF 11) 
ModRM.reg encodes all other registers None (valid) 
EVEX.X P[6] ModRM.r/m encodes ZMM/YMM/XMM None (valid) 
ModRM.r/m encodes k-reg or GPR None (ignored) 
ModRM.r/m without SIB/VSIB None (ignored) 
ModRM.r/m with SIB/VSIB None (valid) 
EVEX.B P[5] ModRM.r/m encodes k-reg one (ignored) None (ignored) 
ModRM.r/m encodes other registers None (valid) 
ModRM.r/m base present None (valid) 
ModRM.r/m base not present None (ignored) 
EVEX.R’ P[4] ModRM.reg encodes k-reg or GPR If O None (ignored) 
ModRM.reg is opcode extension None (ignored) 
ModRM.reg encodes ZMM/YMM/XMM None (valid) 
EVEX.vvvv P[14:11] | vwvv encodes ZMM/YMM/XMM None (valid) None (valid) 
P[14] ignored 
Otherwise If !=1111b lf!l=1111b 
EVEX.V' P[19] Encodes ZMM/YMM/XMM None (valid) lf O 
Otherwise If 0 If 0 


Table 2-40 lists the #UD conditions of instruction encoding of opmask register using EVEX.aaa and EVEX.z 


Table 2-40. #UD Conditions of Opmask Related Encoding Field 


Notation Position Operand Encoding 64-bit HUD Non-64-bit HUD 
EVEX.aaa P[18:16] | Instructions do not use opmask for conditional processing!. If aaa != OOOb If aaa != OOOb 
Opmask used as conditional processing mask and updated | If aaa = OOOb If aaa = OOOb; 
at completion2. 
Opmask used as conditional processing. None (valid?) None (valid’) 
EVEX.z P[23] Vector instruction using opmask as source or destination*. | If EVEX.z != 0 If EVEX.z != 0 
Store instructions or gather/scatter instructions. If EVEX.z != 0 If EVEX.z != 0 
Instructions with EVEX.aaa = OOOb. If EVEX.z != O If EVEX.z != O 
VEX.vvvv Varies K-regs are instruction operands not mask control. If vvvv = Oxxxb None 
NOTES: 


1. E.g., VPBROADCASTMxxx, VPMOVM2x, VPMOVx2M. 
2. E.g., Gather/Scatter family. 


3. aaa can take any value. A value of 000 indicates that there is no masking on the instruction; in this case, all elements will be pro- 
cessed as if there was a mask of ‘all ones’ regardless of the actual value in KO. 


4. E.g., VFPCLASSPD/PS, VCMPB/D/Q/W family, VPMOVM2x, VPMOVx2M. 
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Table 2-41 lists the #UD conditions of EVEX bit fields that depends on the context of EVEX.b. 


Table 2-41. #UD Conditions Dependent on EVEX.b Context 


Notation Position Operand Encoding 64-bit HUD Non-64-bit #UD 
EVEX.L’Lb P[22 : 20] | Reg-reg, FP instructions with rounding semantic. None (valid') None (valid!) 
Other reg-reg, FP instructions that can cause #XM. None (valid?) None (valid?) 
Other reg-mem instructions in Table 2-34. None (valid?) None (valid?) 
Other instruction classes* in Table 2-35. If EVEX.b = 1 If EVEX.b = 1 
NOTES: 


1. UL specifies rounding control, see Table 2-36, supports {er} syntax. 

2.U'Lis ignored. 

3. UL specifies vector length, see Table 2-36, supports embedded broadcast syntax 
4. UL specifies either vector length or ignored. 


2.7.12 Device Not Available 


EVEX-encoded instructions follow the same rules when it comes to generating #NM (Device Not Available) excep- 
tion. In particular, it is generated when CRO.TS[bit 3]= 1. 


2.7.13 Scalar Instructions 


EVEX-encoded scalar SIMD instructions can access up to 32 registers in 64-bit mode. Scalar instructions support 
masking (using the least significant bit of the opmask register), but broadcasting is not supported. 


2.8 EXCEPTION CLASSIFICATIONS OF EVEX-ENCODED INSTRUCTIONS 


The exception behavior of EVEX-encoded instructions can be classified into the classes shown in the rest of this 
section. The classification of EVEX-encoded instructions follow a similar framework as those of AVX and AVX2 
instructions using the VEX prefix. Exception types for EVEX-encoded instructions are named in the style of 

“E##” or with a suffix “E##XX”. The “##” designation generally follows that of AVX/AVX2 instructions. The 
majority of EVEX encoded instruction with “Load+op” semantic supports memory fault suppression, which is repre- 
sented by E##. The instructions with “Load+op” semantic but do not support fault suppression are named 
“E##NF”. Asummary table of exception classes by class names are shown below. 


Table 2-42. EVEX-Encoded Instruction Exception Class Summary 


Exception Class Instruction set Mem arg (#XM) 

Type €1 Vector Moves/Load/Stores Explicitly aligned, w/ fault suppression None 

Type E1NF Vector Non-temporal Stores Explicitly aligned, no fault suppression None 
Type E2 FP Vector Load+op Support fault suppression Yes 
Type E2NF FP Vector Load+op No fault suppression Yes 
Type E3 FP Scalar/Partial Vector, Load+Op Support fault suppression Yes 
Type E3NF FP Scalar/Partial Vector, Load+Op No fault suppression Yes 
Type E4 Integer Vector Load+op Support fault suppression No 
Type E4NF Integer Vector Load+op No fault suppression No 
Type €5 Legacy-like Promotion Varies, Support fault suppression No 
Type ESNF Legacy-like Promotion Varies, No fault suppression No 
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Table 2-42. EVEX-Encoded Instruction Exception Class Summary (Contd.) 


Exception Class Instruction set Mem arg (#XM) 
Type E6 Post AVX Promotion Varies, w/ fault suppression No 
Type E6NF Post AVX Promotion Varies, no fault suppression No 
Type E7NM Register-to-register op None None 
Type ESNF Miscellaneous 128-bit Vector-length Specific, no fault suppression None 
Type E10 Non-XF Scalar Vector Length ignored, w/ fault suppression None 
Type E10NF Non-XF Scalar Vector Length ignored, no fault suppression None 
Type E11 VCVTPH2PS, VCVTPS2PH Half Vector Length, w/ fault suppression Yes 
Type E12 Gather and Scatter Family VSIB addressing, w/ fault suppression None 
Type E12NP Gather and Scatter Prefetch Family VSIB addressing, w/o page fault None 


Table 2-43 lists EVEX-encoded instruction mnemonic by exception classes. 


Table 2-43. EVEX Instructions in Each Exception Class 


Exception Class 


Instruction 


Type €1 


VMOVAPD, VMOVAPS, VMOVDQA32, VMOVDQA64 


Type E1NF 


VMOVNTDQ, VMOVNTDOA, VMOVNTPD, VMOVNTPS 


Type E2 


VADDPD, VADDPH, VADDPS, VCMPPD, VCMPPH, VCMPPS, VCVTDQ2PH, VCVTDQ2PS, VCVTPD2DQ, VCVTPD2PH, 
VCVTPD2PS, VCVTPD2QQ, VCVTPD2UQQ, VCVTPD2UDQ, VCVTPH2DQ, VCVTPH2PD, VCVTPH2QQ, VCVTPH2UDQ, 
VCVTPH2UQQ, VCVTPH2UW, VCVTPH2W, VCVTPS2DQ, VCVTPS2UDOS, VCVTQQ2PD, VCVTQQ2PH, VCVTQQ2PS, 
VCVTTPD2DQ, VCVTTPD2QQ, VCVTTPD2UDQ, VCVTTPD2UQQ, VCVTTPH2DQ, VCVTTPH2QQ, VCVTTPH2UDQ, 
VCVTTPH2UQQ, VCVTTPH2UW, VCVTTPH2W, VCVTTPS2DQ, VCVTTPS2UDQ, VCVTUDQ2PH, VCVTUDQ2PS, 
VCVTUQQ2PD, VCVTUQQ2PH, VCVTUQQ2PS, VCVTUW2PH, VCVTW2PH, VDIVPD, VDIVPH, VDIVPS, VEXP2PD, 
VEXP2PS, VFIXUPIMMPD, VFIXUPIMMPS, VFMADDxxxPD, VFMADDxxxPH, VFMADDxxxPS, VFMADDSUBxxxPD, 
VFMADDSUBxxxPH, VFMADDSUBxxxPS, VFMSUBADDxxxPD, VFMSUBADDxxxPH, VFMSUBADDxxxPS, 
VFMSUBxxxPD, VFMSUBxxxPH, VFMSUBxxxPS, VFNMADDxxxPD, VFNMADDxxxPH, VFNMADDxxxPS, 
VFNMSUBxxxPD, VFNMSUBxxxPH, VFNMSUBxxxPS, VGETEXPPD, VGETEXPPH, VGETEXPPS, VGETMANTPD, 
VGETMANTPH, VGETMANTPS, VGETMANTSH, VMAXPD, VMAXPH, VMAXPS, VMINPD, VMINPH, VMINPS, VMULPD, 
VMULPH, VMULPS, VRANGEPD, VRANGEPS, VREDUCEPD, VREDUCEPH, VREDUCEPS, VRNDSCALEPD, 
VRNDSCALEPH, VRNDSCALEPS, VRCP28PD, VRCP28PS, VRSORT28PD, VRSQRTZ8PS, VSCALEFPD, VSCALEFPS, 
VSQRTPD, VSQRTPH, VSQRTPS, VSUBPD, VSUBPH, VSUBPS 


Type E3 


VADDSD, VADDSH, VADDSS, VCMPSD, VCMPSH, VCMPSS, VCVTPS2QQ, VCVTPS2UQQ, VCVTPS2PD, VCVTSD2SH, 
VCVTSD2SS, VCVTSH2SD, VCVTSH2SS, VCVTSS2SD, VCVTSS2SH, VCVTTPS2QQ, VCVTTPS2UQQ, VDIVSD, VDIVSH, 
VDIVSS, VFMADDxxxSD, VFMADDxxxSH, VFMADDxxxSS, VFMSUBxxxSD, VFMSUBxxxSH, VFMSUBxxxSS, 
VFNMADDxxxSD, VFNMADDxxxSH, VFNMADDxxxSS, VFNMSUBxxxSD, VFNMSUBxxxSH, VFNMSUBxxxSS, 
VFIXUPIMMSD, VFIXUPIMMSS, VGETEXPSD, VGETEXPSH, VGETEXPSS, VGETMANTSD, VGETMANTSH, 
VGETMANTSS, VMAXSD, VMAXSH, VMAXSS, VMINSD, VMINSH, VMINSS, VMULSD, VMULSH, VMULSS, VRANGESD, 
VRANGESS, VREDUCESD, VREDUCESH, VREDUCESS, VRNDSCALESD, VRNDSCALESH, VRNDSCALESS, VSCALEFSD, 
VSCALEFSH, VSCALEFSS, VRCP28SD, VRCP28SS, VRSQRT28SD, VRSORT28SS, VSORTSD, VSORTSH, VSORTSS, 
VSUBSD, VSUBSH, VSUBSS 


Type E3NF 


VCOMISD, VCOMISH, VCOMISS, VCVTSD2SI, VCVTSD2USI, VCVTSH2SI, VCVTSH2USI, VCVTSI2SD, VCVTSI2SH, 
VCVTSI2SS, VCVTSS2SI, VCVTSS2USI, VCVTTSD2SI, VCVTTSD2USI, VCVTTSH2SI, VCVTTSH2USI, VCVTTSS2SI, 
VCVTTSS2USI, VCVTUSI2SD, VCVTUSI2SH, VCVTUSI2SS, VUCOMISD, VUCOMISH, VUCOMISS 
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Table 2-43. EVEX Instructions in Each Exception Class (Contd.) 


Exception Class 


Instruction 


Type E4 


VANDPD, VANDPS, VANDNPD, VANDNPS, VBLENDMPD, VBLENDMPS, VFCMADDCPH, VFCMULCPH, VFMADDCPH, 
VFMULCPH, VFPCLASSPD, VFPCLASSPH, VFPCLASSPS, VORPD, VORPS, VPABSD, VPABSQ, VPADDD, VPADDQ, 
VPANDD, VPANDQ, VPANDND, VPANDNQ, VPBLENDMB, VPBLENDMD, VPBLENDMQ, VPBLENDMW, VPCMPD, 
VPCMPEQD, VPCMPEQQ, VPCMPGTD, VPCMPGTQ, VPCMPQ, VPCMPUD, VPCMPUQ, VPLZCNTD, VPLZCNTQ, 
VPMADD52LUQ, VPMADD52HUQ, VPMAXSD, VPMAXSQ, VPMAXUD, VPMAXUQ, VPMINSD, VPMINSQ, VPMINUD, 
VPMINUQ, VPMULLD, VPMULLQ, VPMULUDQ, VPMULDQ, VPORD, VPORQ, VPROLD, VPROLQ, VPROLVD, VPROLVQ, 
VPRORD, VPRORQ, VPRORVD, VPRORVQ, (VPSLLD, VPSLLQ, VPSRAD, VPSRAQ, VPSRAVW, VPSRAVD, VPSRAVW, 
VPSRAVQ, VPSRLD, VPSRLQ)', VPSUBD, VPSUBQ, VPSUBUSB, VPSUBUSW, VPTERNLOGD, VPTERNLOGQ, 
VPTESTMD, VPTESTMQ, VPTESTNMD, VPTESTNMQ, VPXORD, VPXORQ, VPSLLVD, VPSLLVQ, VRCP14PD, 
VRCP14PS, VRCPPH, VRSQRT14PD, VRSQRT14PS, VRSQRTPH, VXORPD, VXORPS 


E4.nb@ 


VCOMPRESSPD, VCOMPRESSPS, VEXPANDPD, VEXPANDPS, VMOVDQU8, VMOVDQU16, VMOVDQU32, 
VMOVDQU64, VMOVUPD, VMOVUPS, VPABSB, VPABSW, VPADDB, VPADDW, VPADDSB, VPADDSW, VPADDUSB, 
VPADDUSW, VPAVGB, VPAVGW, VPCMPB, VPCMPEQB, VPCMPEQW, VPCMPGTB, VPCMPGTW, VPCMPW, VPCMPUB, 
VPCMPUW, VPCOMPRESSD, VPCOMPRESSQ, VPEXPANDD, VPEXPANDQ, VPMAXSB, VPMAXSW, VPMAXUB, 
VPMAXUW, VPMINSB, VPMINSW, VPMINUB, VPMINUW, VPMULHRSW, VPMULHUW, VPMULHW, VPMULLW, 
VPSLLVW, VPSLLW, VPSRAW, VPSRLVW, VPSRLW, VPSUBB, VPSUBW, VPSUBSB, VPSUBSW, VPTESTMB, 
VPTESTMW, VPTESTNMB, VPTESTNMW 


Type E4NF 


VALIGND, VALIGNQ, VPACKSSDW, VPACKUSDW, VPCONFLICTD, VPCONFLICTQ, VPERMD, VPERMI2D, VPERMIZPS, 
VPERMI2PD, VPERMI2Q, VPERMPD, VPERMPS, VPERMQ, VPERMT2D, VPERMT2PS, VPERMT2Q, VPERMT2PD, 
VPERMILPD, VPERMILPS, VPMULTISHIFTQB, VPSHUFD, VPUNPCKHDQ, VPUNPCKHQDQ, VPUNPCKLDQ, 
VPUNPCKLQDQ, VSHUFF32X4, VSHUFF64X2, VSHUFI32X4, VSHUFI64X2, VSHUFPD, VSHUFPS, VUNPCKHPD, 
VUNPCKHPS, VUNPCKLPD, VUNPCKLPS 


E4NF.nb2 


VDBPSADBW, VPACKSSWB, VPACKUSWB, VPALIGNR, VPMADDWD, VPMADDUBSW, VMOVSHDUP, VMOVSLDUP, 
VPSADBW, VPSHUFB, VPSHUFHW, VPSHUFLW, VPSLLDQ, VPSRLDQ, VPSLLW, VPSRAW, VPSRLW, (VPSLLD, 
VPSLLQ, VPSRAD, VPSRAQ, VPSRLD, VPSRLQ)?, VPUNPCKHBW, VPUNPCKHWD, VPUNPCKLBW, VPUNPCKLWD, 
VPERMW, VPERMI2W, VPERMT2W 


Type E5 


PMOVSXBW, PMOVSXBW, PMOVSXBD, PMOVSXBQ, PMOVSXWD, PMOVSXWQ, PMOVSXDQ, PMOVZXBW, 
PMOVZXBD, PMOVZXBQ, PMOVZXWD, PMOVZXWQ, PMOVZXDQ, VCVTDQ2PD, VCVTUDQ2PD, VMOVSH, 
VPMOVSXxx, VPMOVZXxx, 


Type ESNF 


VMOVDDUP 


Type E6 


VBROADCASTF32X2, VBROADCASTF32X4, VBROADCASTF64X2, VBROADCASTF32X8, VBROADCASTF64X4, 
VBROADCASTI32X2, VBROADCASTI32X4, VBROADCASTI64X2, VBROADCASTI32X8, VBROADCASTI64X4, 
VBROADCASTSD, VBROADCASTSS, VFPCLASSSD, VFPCLASSSS, VPBROADCASTB, VPBROADCASTD, 
VPBROADCASTW, VPBROADCASTQ, VPMOVQB, VPMOVSQB, VPMOVUSQB, VPMOVQW, VPMOVSQW, VPMOVUSQW, 
VPMOVQD, VPMOVSQD, VPMOVUSQD, VPMOVDB, VPMOVSDB, VPMOVUSDB, VPMOVDW, VPMOVSDW, 
VPMOVUSDW, VPMOVWB, VPMOVSWB, VPMOVUSWB 


Type E6NF 


Type 
€7NM.128+ 


VEXTRACTF32X4, VEXTRACTF32X8, VEXTRACTF64X2, VEXTRACTF64X4, VEXTRACTI32X4, VEXTRACTI32X8, 
VEXTRACTI64X2, VEXTRACTI64X4, VINSERTF32X4, VINSERTF32X8, VINSERTF64X2, VINSERTF64X4, 
VINSERTI32X4, VINSERTI32X8, VINSERTI64X2, VINSERTI64X4, VPBROADCASTMB2Q, VPBROADCASTMW2D 


VMOVHLPS, VMOVLHPS 


Type E7NM. 


(VPBROADCASTD, VPBROADCASTQ, VPBROADCASTB, VPBROADCASTW)?, VPMOVB2M, VPMOVD2M, VPMOVM2B, 
VPMOVM2D, VPMOVM2Q, VPMOVM2W, VPMOVQ2M, VPMOVW2M 


Type EONF 


VEXTRACTPS, VINSERTPS, VMOVHPD, VMOVHPS, VMOVLPD, VMOVLPS, VMOVD, VMOVQ, VMOVW, VPEXTRB, 
VPEXTRD, VPEXTRW, VPEXTRQ, VPINSRB, VPINSRD, VPINSRW, VPINSRQ 


Type E10 


Type E10NF 


VFCMADDCSH, VFMADDCSH, VFCMULCSH, VFMULCSH, VFPCLASSSH, VMOVSD, VMOVSS, VRCP14SD, VRCP14SS, 
VRCPSH, VRSQRT14SD, VRSQRT14SS, VRSQRTSH 


(VCVTSI2SD, VCVTUSI2SD)® 


Type €11 


VCVTPH2PS, VCVTPS2PH 


Vol.2A 2-47 


INSTRUCTION FORMAT 


Table 2-43. EVEX Instructions in Each Exception Class (Contd.) 


Exception Class Instruction 


VGATHERDPS, VGATHERDPD, VGATHEROPS, VGATHERQPD, VPGATHERDD, VPGATHERDQ, VPGATHERQD, 
Type E12 VPGATHERQQ, VPSCATTERDD, VPSCATTERDQ, VPSCATTERQD, VPSCATTERQQ, VSCATTERDPD, VSCATTERDPS, 
VSCATTERQPD, VSCATTERQPS 


VGATHERPFODPD, VGATHERPFODPS, VGATHERPFOQPD, VGATHERPFOOPS, VGATHERPF1 DPD, VGATHERPF1DPS, 
Type €12NP_—_| VGATHERPF1QPD, VGATHERPF1 QPS, VSCATTERPFODPD, VSCATTERPFODPS, VSCATTERPFOQPD, 
VSCATTERPFOOQOPS, VSCATTERPF1DPD, VSCATTERPF1 DPS, VSCATTERPF1QPD, VSCATTERPF1QPS 


NOTES: 

1. Operand encoding Full tupletype with immediate. 

2. Embedded broadcast is not supported with the “.nb” suffix. 
3. Operand encoding Mem1 28 tupletype. 

4. #UD raised if EVEX.L'L !=00b (VL=1 28). 

5. The source operand is a general purpose register. 

6. WO encoding only. 


2-48 Vol. 2A 


INSTRUCTION FORMAT 


2.8.1 Exceptions Type E1 and E1NF of EVEX-Encoded Instructions 


EVEX-encoded instructions with memory alignment restrictions, and supporting memory fault suppression follow 
exception class E1. 


Table 2-44. Type €1 Class Exception Conditions 


wo a) 
2/8 
3 | 8 |esl|s 
Exception a — |S | = Cause of Exception 
a oO oa 
3 £E| © 
= So 
> |aVv 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

X se | Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 

* Opmask encoding #UD condition of Table 2-40. 

* E€VEX.b encoding #UD condition of Table 2-41. 

* Instruction specific EVEX.L'L restriction not met. 


X X X X_ | If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Invalid Opcode, 
#UD 


Device NotAvai- | y | y | yx | x |tecroTspbit3]=1. 


able, #NM 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) y__| If fault suppression not set, and a memory address referencing the SS segment is in 
a non-canonical form. 
EVEX.512: Memory operand is not 64-byte aligned. 
X X_ | EVEX.256: Memory operand is not 32-byte aligned. 
EVEX.128: Memory operand is not 16-byte aligned. 
General Protection, X If fault suppression not set, and an illegal memory operand effective address in the 
#GP(0) CS, DS, ES, FS or GS segments. 
X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
Page Fault 


X X X_| If fault suppression not set, and a page fault. 


#PF(fault-code) 
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EVEX-encoded instructions with memory alignment restrictions, but do not support memory fault suppression 
follow exception class E1NF. 


Table 2-45. Type E1NF Class Exception Conditions 


wo i) 
2 \|se 
3s | 8 |eel|s 
Exception o -= |tal ¥y Cause of Exception 
« e |g 
| Le wo 
= ° ro) 
5S |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 
EVEX.b encoding #UD condition of Table 2-41. 
Instruction specific EVEX.L’L restriction not met. 


Invalid Opcode, 
#UD 


Xx X X X_ | If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘O’. 


Device Not Avail- 
able, #NM 


X For an illegal address in the SS segment. 


X X X X | If CRO.TS[bit 3]=1. 


Stack, #SS(0 
) X_ | lfamemory address referencing the SS segment is in a non-canonical form. 


EVEX.512: Memory operand is not 64-byte aligned. 
X X | EVEX.256: Memory operand is not 32-byte aligned. 
EVEX.128: Memory operand is not 16-byte aligned. 


General Protection, x For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 


X_ | If the memory address is in a non-canonical form. 


X X If any part of the operand lies outside the effective address space from O to FFFFH. 


Page Fault 


#PF(fault-code) X X X_ | For a page fault. 
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Exceptions Type E2 of EVEX-Encoded Instructions 


EVEX-encoded vector instructions with arithmetic semantic follow exception class E2. 


Table 2-46. Type E2 Class Exception Conditions 


ao) 
8/52 
—|8 |va/# 
Exception o|<s5/25hl 2 Cause of Exception 
xi; Sigaig 
Ess 
> av 
X X If EVEX prefix present. 
X X X X | lf an unmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 0. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
Invalid Opcode, X X |= Opcode independent #UD condition in Table 2-38. 
#UD * Operand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
« Instruction specific EVEX.L'L restriction not met. 
X X If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X_ | lf any corresponding CPUID feature flag is ‘0’. 
Device Not Avail- ora, 
able, #NM X X X X | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x._| If fault suppression not set, and a memory address referencing the SS segment is ina 
non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the CS, 
DS, ES, FS or GS segments. 
General Protec- , = , 
tion, #GP(0) X_ | If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
Page Fault ' 
#PF(fault-code) X X X | If fault suppression not set, and a page fault. 
Alignment Check For 2, 4, or 8 byte memory access if alignment checking is enabled and an unaligned 
X X X : : a : 
#AC(0) memory access is made while the current privilege level is 3. 
SIMD Floating- : ‘ : 
point Exception, X X X X ie ra Ses SIMD floating-point exception, {sae} or {er} not set, and CR4.0SXMMEX- 
#XM [bit 10] = 1. 
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2.8.3 


Exceptions Type E3 and E3NF of EVEX-Encoded Instructions 


EVEX-encoded scalar instructions with arithmetic semantic that support memory fault suppression follow exception 


class E3. 
Table 2-47. Type E3 Class Exception Conditions 
wo CT D> 
2 \/ss 
as | 8 |/38/ 5 
Exception 2 ae 3 3 < Cause of Exception 
=) fel © 
E jes 
> |av 
X X If EVEX prefix present. 
X X X X | lfanunmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 0. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
; X X |= Qpcode independent #UD condition in Table 2-38. 
Invalid Opcode, #UD * Operand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
Xx X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X_| If any corresponding CPUID feature flag is ‘O’. 
Device Not Available, X X X X | IFCRO.TS[bit 3]=1. 
#NM 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x _ If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in 
the CS, DS, ES, FS or GS segments. 
G, puoteeuen X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
ee Paull athe (Fult- X X X_ | If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
SIMD Floating-point Xx X X x If an unmasked SIMD floating-point exception, {sae} or {er} not set, and CR4.0SX- 


Exception, #XM 


MMEXCPT[bit 10] = 1. 
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EVEX-encoded scalar instructions with arithmetic semantic that do not support memory fault suppression follow 
exception class E3NF. 


Table 2-48. Type E3NF Class Exception Conditions 


wo TU > 
QR \|se 
a | 8 |ees|s 
Exception & = 3 @| + Cause of Exception 
=| £eE ie) 
Ee /e6 
> jar 
X X EVEX prefix. 
X X X X | lfan unmasked SIMD floating-point exception and CR4.0SXMMEXCPTI[bit 10] = 0. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
; X X |= Opcode independent #UD condition in Table 2-38. 
Invalid Opcode, #UD * QOperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
X X X_ | If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
Xx X X X_ | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, eee 
#NM X X X X | If CRO.TS[bit 3]=1. 
X For an illegal address in the SS segment. 
Stack, #SS(0) - — - 
X | lfamemory address referencing the SS segment is in a non-canonical form. 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 
ey Protection, X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault #PF(fault- X X x | Fora page fault. 
code) 
Alignment Check Xx X xX For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
SIMD Floating-point X X X xX If an unmasked SIMD floating-point exception, {sae} or {er} not set, and CR4.0SX- 
Exception, #XM MMEXCPT[bit 10] = 1. 
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2.8.4 Exceptions Type E4 and E4NF of EVEX-Encoded Instructions 


EVEX-encoded vector instructions that cause no SIMD FP exception and support memory fault suppression follow 
exception class E4. 


Table 2-49. Type E4 Class Exception Conditions 


wo a) 
2 [ss 

3 | 8 |esl| Ss 

Exception 2 = | o| } Cause of Exception 

3/2 = wo 
z So 
> /ae 

X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
* Qpcode independent #UD condition in Table 2-38. 
= Qperand encoding #UD conditions in Table 2-39. 
: * Opmask encoding #UD condition of Table 2-40. 
Invalid Opcode, #UD » EVEX.b encoding #UD condition of Table 2-41 and in E4.nb subclass (see E4.nb 
entries in Table 2-43). 
* Instruction specific EVEX.L’L restriction not met. 


X X X X_ | If preceded by a LOCK prefix (FOH). 


X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X If fault suppression not set, and an illegal address in the SS segment. 


Stack, #SS(0) x__| If fault suppression not set, and a memory address referencing the SS segment is 


in a non-canonical form. 


X If fault suppression not set, and an illegal memory operand effective address in 
General Protection, the CS, DS, ES, FS or GS segments. 
#GP(0) X_| If fault suppression not set, and the memory address is in a non-canonical form. 

X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 

ea REE (fantt: X X X_| If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded vector instructions that do not cause SIMD FP exception nor support memory fault suppression 
follow exception class E4NF. 


Table 2-50. Type E4NF Class Exception Conditions 


® |ee 
x | c= 
3s |e jae s 
Exception a = || ¥ Cause of Exception 
a eo }ga 
=) Le wo 
E jes 
> |av 
X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
* Opcode independent #UD condition in Table 2-38. 
X X |= Operand encoding #UD conditions in Table 2-39. 
. «= Opmask encoding #UD condition of Table 2-40. 
Invalid Opcade, #UD = EVEX.b encoding #UD condition of Table 2-41 and in E4NE.nb subclass (see 
E4NF.nb entries in Table 2-43). 
« Instruction specific EVEX.L'L restriction not met. 


X X Xx X_ | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X_| If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 


X For an illegal address in the SS segment. 


Stack, #SS(0 
0) X | lfamemory address referencing the SS segment is in a non-canonical form. 


xX For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, Ment: 
#GP(0) X_| If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from 0 to 
FFFFH. 


Page Fault #PF(fault- 


code) X X X | For a page fault. 
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2.8.5 


Exceptions Type E5 and ESNF 


EVEX-encoded scalar/partial-vector instructions that cause no SIMD FP exception and support memory fault 


suppression follow exception class E5. 


Table 2-51. Type E5 Class Exception Conditions 


Exception 


Real 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


x< 


>< | Virtual 80x86 


If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

* QOpcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 
EVEX.b encoding #UD condition of Table 2-41. 
Instruction specific EVEX.L'L restriction not met. 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 
#NM 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


General Protection, 
#GP(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF(fault- 
code) 


Alignment Check 
#AC(0) 


If fault suppression not set, and a page fault. 


For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
unaligned memory access is made while the current privilege level is 3. 


EVEX-encoded scalar/partial vector instructions that do not cause SIMD FP exception nor support memory fault 
suppression follow exception class ESNF. 
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Table 2-52. Type E5NF Class Exception Conditions 


wo a 
2 | ss 
, 3 | 8 |3e|s 
Exception & = o @| + Cause of Exception 
=) £eE| © 
E lego 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X y |* Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
« Instruction specific EVEX.L’L restriction not met. 
X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, ee 
#NM X X X X_ | If CRO.TS[bit 3]=1. 
X If an illegal address in the SS segment. 
Stack, #SS(0) - — - 
X | lfamemory address referencing the SS segment is in a non-canonical form. 
X If an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
General Protection, X_ | If the memory address is in a non-canonical form. 
#GP(0) If any part of the operand lies outside the effective address space from 0 to 
X X 
FFFFH. 
Page Fault #PF(fault- xX X Xx | Fora page fault. 
code) 
Alignment Check xX X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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2.8.6 Exceptions Type E6 and E6NF 
Table 2-53. Type E6 Class Exception Conditions 
g \ze 
x | 9= 
3s |e lass 
Exception 2 = 3 @| + Cause of Exception 
2 l/e#e|° 
= a) 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X x |" Opcode independent #UD condition in Table 2-38. 
« Operand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
« Instruction specific EVEX.L'L restriction not met. 
X X_ | If preceded by a LOCK prefix (FOH). 
Xx X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X_ | If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, se ui 
#NM X X | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x. | If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
; X If fault suppression not set, and an illegal memory operand effective address in the 
ati Protection, CS, DS, ES, FS or GS segments. 
X_| If fault suppression not set, and the memory address is in a non-canonical form. 
aad erent: X X_| If fault suppression not set, and a page fault. 
Alignment Check xX Xx For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded instructions that do not cause SIMD FP exception nor support memory fault suppression follow 


exception class E6NF. 


Table 2-54. Type E6NF Class Exception Conditions 


wo TU > 
2/5 
a |e |es| 5s 
Exception 2 3 3 o t Cause of Exception 
e |3§ 
Ss |a9 
Invalid Opcode, #UD X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
X ale Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
» Instruction specific EVEX.L’'L restriction not met. 
X X_ | If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X_ | If any corresponding CPUID feature flag is ‘0’. 
eas Nor pyelae x | X | IfCRO.TS[bit 3]=1. 
Stack, #SS(0) X For an illegal address in the SS segment. 
ack, 
X | Ifamemory address referencing the SS segment is in a non-canonical form. 
foeieee X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
eneral Protection, ments. 
#GP(0) = ; 
X_ | If the memory address is in a non-canonical form. 
Bei Fault FPF Fault: X | X | Fora page fault. 
Alignment Check X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
#AC(0) unaligned memory access is made while the current privilege level is 3. 
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2.8.7 Exceptions Type E7NM 


EVEX-encoded instructions that cause no SIMD FP exception and do not reference memory follow exception class 
E7NM. 


Table 2-55. Type E7NM Class Exception Conditions 


wo —T > 
2 [ss 

3 | 8 |eel| Ss 

Exception 2 = | | } Cause of Exception 

3 |g = wo 
z a) 
> /aV 

X X If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

X x |" Opcode independent #UD condition in Table 2-38. 
« QOperand encoding #UD conditions in Table 2-39. 

* Opmask encoding #UD condition of Table 2-40. 

* E€VEX.b encoding #UD condition of Table 2-41. 

« Instruction specific EVEX.L'L restriction not met. 


Invalid Opcode, #UD 


X X X X_ | If preceded by a LOCK prefix (FOH). 
X X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


X X X X_ | If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, ene 
#NM X X | If CRO.TS[bit 3]=1. 
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Exceptions Type E9 and EONF 


EVEX-encoded vector or partial-vector instructions that do not cause no SIMD FP exception and support memory 


fault suppression follow exception class E9. 


Table 2-56. Type E9 Class Exception Conditions 


Exception 


Real 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


x< 


>< | Virtual 80x86 


If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

* State requirement, Table 2-37 not met. 

* QOpcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 
EVEX.b encoding #UD condition of Table 2-41. 
Instruction specific EVEX.L'L restriction not met. 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 
#NM 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


General Protection, 
#GP(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF(fault- 
code) 


Alignment Check 
#AC(0) 


If fault suppression not set, and a page fault. 


For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded vector or partial-vector instructions that must be encoded with VEX.L’L = 0, do not cause SIMD FP 
exception nor support memory fault suppression follow exception class EONF. 


Table 2-57. Type EONF Class Exception Conditions 


#AC(0) 
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wo ay 
ae 
, 3s | 8 |3e|s 
Exception 2 = 3 @| + Cause of Exception 
=| Le wo 
Ee les 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
X |e Opcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
« Instruction specific EVEX.L'L restriction not met. 
X X If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X X X_ | If any corresponding CPUID feature flag is ‘O’. 
Device Not Available, X X X x | If CRO.TS[bit 3]=1. 
#NM 
X If an illegal address in the SS segment. 
Stack, #SS(0) - — - 
X | lfamemory address referencing the SS segment is in a non-canonical form. 
X If an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
General Protection, X_ | lf the memory address is in a non-canonical form. 
#GP(O) If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH. 
Page Fault #PF(fault- X X x | Fora page fault 
code) 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


unaligned memory access is made while the current privilege level is 3. 
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2.8.9 Exceptions Type E10 and E10NF 


EVEX-encoded scalar instructions that ignore EVEX.L’L vector length encoding, do not cause a SIMD FP exception, 
and support memory fault suppression follow exception class E10. 


Table 2-58. Type E10 Class Exception Conditions 


(fe) Tm D> 
2 | s 
3s | 8 |esl| 5 ; 
Exception & = o @| + Cause of Exception 
=) fel] © 
‘= So 
> |av 
X X If EVEX prefix present. 
If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
X X |= Opcode independent #UD condition in Table 2-38. 
; * QOperand encoding #UD conditions in Table 2-39. 
Invalid Opcode, #UD * Opmask encoding #UD condition of Table 2-40. 
* E€VEX.b encoding #UD condition of Table 2-41. 
X X If preceded by a LOCK prefix (FOH). 
X | If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 
X X If any corresponding CPUID feature flag is ‘0’. 
Device Not Available, eae 
#NM X X X X | If CRO.TS[bit 3]=1. 
X If fault suppression not set, and an illegal address in the SS segment. 
Stack, #SS(0) x__| If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 
X If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 
pay BLOLeCuen: X_| If fault suppression not set, and the memory address is in a non-canonical form. 
X X If fault suppression not set, and any part of the operand lies outside the effective 
address space from O to FFFFH. 
ee al ane fault: X X X_ | If fault suppression not set, and a page fault. 
Alignment Check X X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


#AC(0) 


unaligned memory access is made while the current privilege level is 3. 
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EVEX-encoded scalar instructions that ignore EVEX.L’L vector length encoding, do not cause a SIMD FP exception, 
and do not support memory fault suppression follow exception class ELONF. 


Table 2-59. Type E10NF Class Exception Conditions 


Exception 


Real 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


x< 


>< | Virtual 80x86 


If EVEX prefix present. 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

= QOpcode independent #UD condition in Table 2-38. 
* QOperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 

* E€VEX.b encoding #UD condition of Table 2-41. 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 
#NM 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 


in a non-canonical form. 


General Protection, 
#GP(0) 


If fault suppression not set, and an illegal memory operand effective address in the 
CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF(fault- 
code) 


If fault suppression not set, and a page fault. 


Alignment Check 
#AC(0) 
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For 2, 4, or 8 byte memory access if alignment checking is enabled and an 
unaligned memory access is made while the current privilege level is 3. 


2.8.10 


INSTRUCTION FORMAT 


Exceptions Type E11 (EVEX-only, Mem Arg, No AC, Floating-point Exceptions) 


EVEX-encoded instructions that can cause SIMD FP exception, memory operand support fault suppression but do 


not cause #AC follow exception class E11. 


Table 2-60. Type E11 Class Exception Conditions 


Exception 


Real 


Virtual 80x86 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


X 


If EVEX prefix present. 


x< 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

* QOpcode independent #UD condition in Table 2-38. 
« QOperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 

= E€VEX.b encoding #UD condition of Table 2-41. 

* Instruction specific EVEX.L’L restriction not met. 


If preceded by a LOCK prefix (FOH). 
If any REX, F2, F3, or 66 prefixes precede a EVEX prefix. 


If any corresponding CPUID feature flag is ‘0’. 


Device Not Available, 
#NM 


< | K| K | X< 


< | K |<] X< 


If CRO.TS[bit 3]=1. 


Stack, #SS(0) 


General Protection, 


If fault suppression not set, and an illegal address in the SS segment. 


If fault suppression not set, and a memory address referencing the SS segment is 
in a non-canonical form. 


If fault suppression not set, and an illegal memory operand effective address in the 


#GP(0) 


CS, DS, ES, FS or GS segments. 


If fault suppression not set, and the memory address is in a non-canonical form. 


If fault suppression not set, and any part of the operand lies outside the effective 
address space from 0 to FFFFH. 


Page Fault #PF (fault- 
code) 


If fault suppression not set, and a page fault. 


If an unmasked SIMD floating-point exception, {sae} not set, and CR4.0SKMMEX- 


SIMD Floating-Point 
Exception, #XM 


CPT[bit 10] = 1. 
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2.8.11 Exceptions Type E12 and E12NP (VSIB Mem Arg, No AC, No Floating-point Exceptions) 


Table 2-61. Type E12 Class Exception Conditions 


o ee 
x< o= 
Exception 3 ® 2 = 5 Cause of Exception 
P a 3s ioe a P 
2 |ee 
= So 
> |av 
Invalid Opcode, HUD | X X If EVEX prefix present. 
X X If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
* State requirement, Table 2-37 not met. 
* QOpcode independent #UD condition in Table 2-38. 
* Qperand encoding #UD conditions in Table 2-39. 
* Opmask encoding #UD condition of Table 2-40. 
* €VEX.b encoding #UD condition of Table 2-41. 
* Instruction specific EVEX.L’L restriction not met. 
= Ifvvvwv!=1111b. 
X X X X If preceded by a LOCK prefix (FOH). 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X X NA | If address size attribute is 16 bit. 
X X X X If ModR/M.mod = ‘11b’. 
X X X X If ModR/M.rm != ‘100b’. 
X X X X If any corresponding CPUID feature flag is ‘0’. 
X X X X If kO is used (gather or scatter operation). 
X X X X If index = destination register (gather operation). 
Device Not Available, | X X X X If CRO.TS[bit 3]=1. 
#NM 
Stack, #SS(0) X For an illegal address in the SS segment. 
X If amemory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
X If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to 
FFFFH. 
Page Fault #PF (fault- X X X For a page fault. 
code) 
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EVEX-encoded prefetch instructions that do not cause #PF follow exception class E12NP. 


Table 2-62. Type E12NP Class Exception Conditions 


INSTRUCTION FORMAT 


Exception 


Real 


Virtual 80x86 


Protected and 


Compatibility 


64-bit 


Cause of Exception 


Invalid Opcode, #UD 


X 


If EVEX prefix present. 


x< 


If CR4.0SXSAVE[bit 18]=0. 

If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

* Opcode independent #UD condition in Table 2-38. 
Operand encoding #UD conditions in Table 2-39. 
Opmask encoding #UD condition of Table 2-40. 
EVEX.b encoding #UD condition of Table 2-41. 
Instruction specific EVEX.L'L restriction not met. 


If preceded by a LOCK prefix (FOH). 


If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 


If address size attribute is 16 bit. 


If ModR/M.mod = ‘11b’, 


If ModR/M.rm != ‘100b’. 
If any corresponding CPUID feature flag is ‘0’. 


If kO is used (gather or scatter operation). 


Device Not Available, 


#NM 


< | K | K< | K | OK) xX 


< | K | OK] OK] OK] OK] OK | OX< 


x< | K | mK | x | XxX 


If CRO.TS[bit 3]=1. 
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29 EXCEPTION CLASSIFICATIONS OF OPMASK INSTRUCTIONS, TYPE K20 AND 
TYPE K21 


The exception behavior of VEX-encoded opmask instructions are listed below. 


2.9.1 Exceptions Type K20 


Exception conditions of Opmask instructions that do not address memory are listed as Type K20. 


Table 2-63. TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg) 


wo TU > 
QZ ist 
a |e |esl Ss 
Exception 2 =z o @| + Cause of Exception 
=] Le wo 
Et ie6 
> |av 
Invalid Opcode, HUD | X X X X If relevant CPUID feature flag is ‘O’. 
X X If a VEX prefix is present. 
X X If CR4.0SXSAVE[bit 18]=0. 


If any one of following conditions applies: 

« State requirement, Table 2-37 not met. 

= Opcode independent #UD condition in Table 2-38. 
* Operand encoding #UD conditions in Table 2-39. 


X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
X X If ModRM:[7:6] != 11b. 


Device Not Available, 


#NM X X X X | If CRO.TS[bit 3]=1. 
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2.9.2 


Exceptions Type K21 


INSTRUCTION FORMAT 


Exception conditions of Opmask instructions that address memory are listed as Type K21. 


Table 2-64. TYPE K21 Exception Definition (VEX-Encoded OpMask Instructions Addressing Memory) 


#AC(0) 


wo TU D> 
2/5 
a |e |ees| 5 
Exception 2 = o @| + Cause of Exception 
a: |= |) 
= |2o 
> |av 
Invalid Opcode, HUD | X X X If relevant CPUID feature flag is ‘O’. 
If a VEX prefix is present. 
X X If CR4.0SXSAVE[bit 18]=0. 
If any one of following conditions applies: 
« State requirement, Table 2-37 not met. 
« Opcode independent #UD condition in Table 2-38. 
« Operand encoding #UD conditions in Table 2-39. 
Device Not Available, X X X x | If CRO.TS[bit 3]=1. 
#NM 
X X If any REX, F2, F3, or 66 prefixes precede a VEX prefix. 
Stack, #SS(0) X X For an illegal address in the SS segment. 
X If a memory address referencing the SS segment is in a non-canonical form. 
General Protection, X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
#GP(0) ments. 
If the DS, ES, FS, or GS register is used to access memory and it contains a null 
segment selector. 
X If the memory address is in a non-canonical form. 
X If any part of the operand lies outside the effective address space from 0 to 
FFFFH. 
Page Fault #PF(fault- X X For a page fault. 
code) 
Alignment Check X X For 2, 4, or 8 byte memory access if alignment checking is enabled and an 


unaligned memory access is made while the current privilege level is 3. 
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2.10 INTEL® AMX INSTRUCTION EXCEPTION CLASSES 


Alignment exceptions: The Intel AMX instructions that access memory will never generate #AC exceptions. 


Table 2-65. Intel? AMX Exception Classes 


Class Description 


¢ #UD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 
¢ #UD if CR4.0SXSAVE F 1. 

¢ #UD if XCRO[18:17] # 0b11. 

¢ HUD if IA32_EFER.LMA4 1 ORCS.L# 1. 


° #UD if VVVV 4 0b1111. 
AMX-E1 


* #GP based on palette and configuration checks (see pseudocode). 
* #GP if the memory address is in a non-canonical form. 


* #5S(0) if the memory address referencing the SS segment is in a non-canonical form. 


* #PF if a page fault occurs. 


¢ HUD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 
¢ #UD if CR4.OSXSAVE # 1. 

¢ #UD if XCRO[18:17] # 0b11. 

¢ #UD if IA32_EFER.LMA #1 ORCS.L#1. 

AMX-E2 ¢ HUD if VVVV 4 0b1111. 


* #GP if the memory address is in a non-canonical form. 


* #5S(0) if the memory address referencing the SS segment is in a non-canonical form. 


* #PF if a page fault occurs. 


« HUD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 

* #UD if CR4.OSXSAVE # 1. 

¢ #UD if XCRO[18:17] # 0b11. 

¢ #UD if IA32_EFER.LMA# 1 ORCS.LF 1. 

° #UD if VVVV 4 0b1111. 

* #UD if not using SIB addressing. 

¢ #UD if TILES CONFIGURED == 0. 

* #UD if tsrc or tdest are not valid tiles. 

AMX-E3 - HUD if tsrc/tdest are = palette_table[tilecfg.palette_id].max_names. 
¢ #UD if tsrc.colbytes mod 4 4 0 OR tdest.colbytes mod 4 # 0. 

¢ HUD if tilecfg.start_row = tsrc.rows OR tilecfg.start_row = tdest.rows. 


* #GP if the memory address is in a non-canonical form. 


* #5S(0) if the memory address referencing the SS segment is in a non-canonical form. 


* #PF if any memory operand causes a page fault. 
° #NM if XFD[18] == 1. 
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Table 2-65. Intel? AMX Exception Classes (Contd.) 


INSTRUCTION FORMAT 


Class 


Description 


AMX-E4 


¢ #UD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 
* #UD if CR4.OSXSAVE # 1. 

¢ #UD if XCRO[18:17] # 0b11. 

¢ #UD if IA32_EFER.LMA4 1 ORCS.L# 1. 

* #UD if srcdest == src1 OR src1 == src2 OR srcdest == src2. 
¢ #UD if TILES CONFIGURED == 0. 

¢ #UD if srcdest.colbytes mod 4 # 0. 

¢ #UD if srci.colbytes mod 4 #0. 

¢ #UD if src2.colbytes mod 4 #0. 

* #UD if srcdest/src1/src2 are not valid tiles. 

* #UD if srcdest/src1/src2 are = palette_table[tilecfg.palette_id].max_names. 
* #UD if srcdest.colbytes 4 src2.colbytes. 

¢ #UD if srcdest.rows # src1.rows. 

* #UD if src1.colbytes / 4 # src2.rows. 

* #UD if srcdest.colbytes > tmul_maxn. 

* #UD if src2.colbytes > tmul_maxn. 

¢ #UD if src1.colbytes/4 > tmul_maxk. 

¢ #UD if src2.rows > tmul_maxk. 


- #NM if XFD[18] == 1. 


AMX-E5 


¢ #UD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 
* #UD if CR4.OSXSAVE # 1. 

¢ #UD if XCRO[18:17] # 0b11. 

° #UD if IA32_EFER.LMA4 1 ORCS.L#1. 

° #UD if VVVV 4 0b1111. 

* #UD if TILES CONFIGURED == 0. 

¢ #UD if tdest is not a valid tile. 

* HUD if tdest is 2 palette_table[tilecfg.palette_id].max_names. 


- #NM if XFD[18] == 1. 


AMX-E6 


¢ #UD if preceded by LOCK, 66H, F2H, F3H or REX prefixes. 
¢ #UD if CR4.OSXSAVE # 1. 

¢ #UD if XCRO[18:17] # 0b11. 

¢ #UD if IA32_EFER.LMA4 1 ORCS.L#1. 

¢ #UD if VVVV 4 0b1111. 
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5. Updates to Chapter 3, Volume 2A 


Change bars and violet text show changes to Chapter 7 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2A: Instruction Set Reference, A-L. 


Changes to this chapter: 


e Updated the CPUID instruction to remove “ECX = 0” from the Last Branch Records Information Leaf (1CH) 
listing because this leaf does not support sub-leaves. 


e Updated the CPUID instruction to add the enumeration of INVD execution prevention after BIOS Done. 


e Updated the INVD instruction to add BIOS Done additions to the description and exception sections. Added an 
exception to Real-Address Mode Exceptions regarding reserved memory protections. 
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CPUID—CPU Identification 


Opcode Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF A2 CPUID ZO | Valid Valid Returns processor identification and feature 


information to the EAX, EBX, ECX, and EDX 
registers, as determined by input entered in 
EAX (in some cases, ECX as well). 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO N/A N/A N/A N/A 
Description 


The ID flag (bit 21) in the EFLAGS register indicates support for the CPUID instruction. If a software procedure can 
set and clear this flag, the processor executing the procedure supports the CPUID instruction. This instruction 
operates the same in non-64-bit modes and 64-bit mode. 


CPUID returns processor identification and feature information in the EAX, EBX, ECX, and EDX registers.! The 
instruction’s output is dependent on the contents of the EAX register upon execution (in some cases, ECX as well). 
For example, the following pseudocode loads EAX with OOH and causes CPUID to return a Maximum Return Value 
and the Vendor Identification String in the appropriate registers: 


MOV EAX, OOH 
CPUID 


Table 3-8 shows information returned, depending on the initial value loaded into the EAX register. 


Two types of information are returned: basic and extended function information. If a value entered for CPUID.EAX 
is higher than the maximum input value for basic or extended function for that processor then the data for the 
highest basic information leaf is returned. For example, using some Intel processors, the following is true: 

CPUID.EAX = O5H (* Returns MONITOR/MWAIT leaf. *) 

CPUID.EAX = OAH (* Returns Architectural Performance Monitoring leaf. *) 

CPUID.EAX = OBH (* Returns Extended Topology Enumeration leaf. x2 

CPUID.EAX =1FH (* Returns V2 Extended Topology Enumeration leaf. x2 

CPUID.EAX = 80000008H (* Returns linear/physical address size data. *) 

CPUID.EAX = 8000000AH (* INVALID: Returns same information as CPUID.EAX = OBH. *) 


If a value entered for CPUID.EAX is less than or equal to the maximum input value and the leaf is not supported on 
that processor then 0 is returned in all the registers. 


When CPUID returns the highest basic leaf information as a result of an invalid input EAX value, any dependence 
on input ECX value in the basic leaf is honored. 


CPUID can be executed at any privilege level to serialize instruction execution. Serializing instruction execution 
guarantees that any modifications to flags, registers, and memory for previous instructions are completed before 
the next instruction is fetched and executed. 


See also: 


“Serializing Instructions” in Chapter 9, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3A. 


“Caching Translation Information” in Chapter 4, “Paging,” in the Intel® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 3A. 


1. On Intel 64 processors, CPUID clears the high 32 bits of the RAX/RBX/RCX/RDxX registers in all modes. 


2. CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence of CPUID leaf 1FH before 
using leaf OBH. 
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Table 3-8. Information Returned by CPUID Instruction 


Initial EAX 
Value Information Provided about the Processor 
Basic CPUID Information 
OH EAX Maximum Input Value for Basic CPUID Information. 
EBX “Genu” 
ECX “ntel” 
EDX “inel” 
01H EAX Version Information: Type, Family, Model, and Stepping ID (see Figure 3-6). 
EBX Bits 07-00: Brand Index. 
Bits 15-08: CLFLUSH line size (Value « 8 = cache line size in bytes; used also by CLFLUSHOPT). 
Bits 23-16: Maximum number of addressable IDs for logical processors in this physical package’. 
Bits 31-24: Initial APIC ID**. 
ECX Feature Information (see Figure 3-7 and Table 3-10). 
EDX Feature Information (see Figure 3-8 and Table 3-11). 
NOTES: 
* The nearest power-of-2 integer that is not smaller than EBX[23:16] is the number of unique initial APIC 
IDs reserved for addressing different logical processors in a physical package. This field is only valid if 
CPUID.1.EDX.HTT[bit 28]= 1. 
** The 8-bit initial APIC ID in EBX[31:24] is replaced by the 32-bit x2APIC ID, available in Leaf OBH and 
Leaf 1FH. 
02H EAX Cache and TLB Information (see Table 3-12). 
EBX Cache and TLB Information. 
ECX Cache and TLB Information. 
EDX Cache and TLB Information. 
03H EAX Reserved. 
EBX Reserved. 
ECX Bits 00-31 of 96-bit processor serial number. (Available in Pentium Ill processor only; otherwise, the 
value in this register is reserved.) 
EDX Bits 32-63 of 96-bit processor serial number. (Available in Pentium Ill processor only; otherwise, the 
value in this register is reserved.) 
NOTES: 


Processor serial number (PSN) is not supported in the Pentium 4 processor or later. On all models, use 
the PSN flag (returned using CPUID) to check for PSN support before accessing the feature. 


CPUID leaves above 2 and below 80000000H are visible only when IA32_MISC_ENABLE[bit 22] has its default value of 0. 


Deterministic Cache Parameters Leaf (Initial EAX Value = 04H) 


04H 


NOTES: 
Leaf 04H output depends on the initial value in ECX.* 
See also: “INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level” on page 251. 


EAX Bits 04-00: Cache Type Field. 
O = Null - No more caches. 
1 = Data Cache. 
2 = Instruction Cache. 
3 = Unified Cache. 
4-31 = Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


EBX 


ECX 
EDX 


Bits 07-05: Cache Level (starts at 1). 
Bit 08: Self Initializing cache level (does not need SW initialization). 
Bit 09: Fully Associative cache. 


Bits 13-10: Reserved. 

Bits 25-14: Maximum number of addressable IDs for logical processors sharing this cache**, ***. 
Bits 31-26: Maximum number of addressable IDs for processor cores in the physical 

package**, BERK balacalalall 


Bits 11-00: L = System Coherency Line Size**. 
Bits 21-12: P = Physical Line partitions**. 
Bits 31-22: W = Ways of associativity**. 


Bits 31-00: S = Number of Sets**. 


Bit 00: Write-Back Invalidate/Invalidate. 
O = WBINVD/INVD from threads sharing this cache acts upon lower level caches for threads sharing this 
cache. 
1 = WBINVD/INVD is not guaranteed to act upon lower level caches of non-originating threads sharing 
this cache. 
Bit 01: Cache Inclusiveness. 
0 = Cache is not inclusive of lower cache levels. 
1 = Cache is inclusive of lower cache levels. 
Bit 02: Complex Cache Indexing. 
O = Direct mapped cache. 
1 = A complex function is used to index the cache, potentially using all address bits. 
Bits 31-03: Reserved = 0. 


NOTES: 

* If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n+1 is invalid if sub- 
leaf n returns EAX[4:0] as 0. 

** Add one to the return value to get the result. 

***The nearest power-of-2 integer that is not smaller than (1 + EAX[25:14]) is the number of unique ini- 
tial APIC IDs reserved for addressing different logical processors sharing this cache. 


**** The nearest power-of-2 integer that is not smaller than (1 + EAX[31:26]) is the number of unique 
Core_IDs reserved for addressing different processor cores in a physical package. Core ID is a subset of 
bits of the initial APIC ID. 


***** The returned value is constant for valid initial values in ECX. Valid ECX values start from 0. 


MONITOR/MWAIT Leaf (Initial EAX Value = O5H) 


O5H 


EAX 


EBX 


ECX 


EDX 


Bits 15-00: Smallest monitor-line size in bytes (default is processor's monitor granularity). 
Bits 31-16: Reserved = 0. 


Bits 15-00: Largest monitor-line size in bytes (default is processor's monitor granularity). 
Bits 31-16: Reserved = 0. 


Bit 00: Enumeration of Monitor-Mwait extensions (beyond EAX and EBX registers) supported. 
Bit 01: Supports treating interrupts as break-event for MWAIT, even when interrupts disabled. 
Bits 31-02: Reserved. 


Bits 03-00: Number of CO* sub C-states supported using MWAIT. 
Bits 07-04: Number of C1* sub C-states supported using MWAIT. 
Bits 11-08: Number of C2* sub C-states supported using MWAIT. 
Bits 15-12: Number of C3* sub C-states supported using MWAIT. 
Bits 19-16: Number of C4* sub C-states supported using MWAIT. 
Bits 23-20: Number of C5* sub C-states supported using MWAIT. 
Bits 27-24: Number of C6* sub C-states supported using MWAIT. 
Bits 31-28: Number of C7* sub C-states supported using MWAIT. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
NOTE: 
* The definition of CO through C7 states for MWAIT extension are processor-specific C-states, not ACPI C- 
states. 
Thermal and Power Management Leaf (Initial EAX Value = OGH) 
O6H EAX Bit 00: Digital temperature sensor is supported if set. 


Bit 01: Intel Turbo Boost Technology available (see description of [A32_MISC_ENABLE[38)}). 

Bit 02: ARAT. APIC-Timer-always-running feature is supported if set. 

Bit 03: Reserved. 

Bit 04: PLN. Power limit notification controls are supported if set. 

Bit 05: ECMD. Clock modulation duty cycle extension is supported if set. 

Bit 06: PTM. Package thermal management is supported if set. 

Bit 07: HWP. HWP base registers (IA32_PM_ENABLE[bit 0], IA32_HWP_CAPABILITIES, IA32_HWP_RE- 
QUEST, IA32_HWP_STATUS) are supported if set. 

Bit 08: HWP_Notification. |A32_HWP_INTERRUPT MSR is supported if set. 

Bit 09: HWP_Activity_Window. IA32_HWP_REQUEST [bits 41:32] is supported if set. 

Bit 10: HWP_Energy_Performance_Preference. |[A32_HwWP_REQUEST[bits 31:24] is supported if set. 
Bit 11: HWP_Package_Level_Request. IA32_HWP_REQUEST_PKG MSR is supported if set. 

Bit 12: Reserved. 

Bit 13: HDC. HDC base registers [A32_PKG_HDC_CTL, IA32_PM_CTL1, IA32_THREAD_STALL MSRs are 
supported if set. 

Bit 14: Intel? Turbo Boost Max Technology 3.0 available. 

Bit 15: HWP Capabilities. Highest Performance change is supported if set. 

Bit 16: HWP PECI override is supported if set. 

Bit 17: Flexible HWP is supported if set. 

Bit 18: Fast access mode for the IA32_HWP_REQUEST MSR is supported if set. 

Bit 19: HwW_FEEDBACK. IA32_Hw_FEEDBACK_PTR MSR, IA32_HwW_FEEDBACK_CONFIG MSR, IA32_PACK- 
AGE_THERM_STATUS MSR bit 26, and IA32_PACKAGE_THERM_INTERRUPT MSR bit 25 are supported if 
set. 

Bit 20: Ignoring Idle Logical Processor HWP request is supported if set. 

Bits 22-21: Reserved. 

Bit 23: Intel® Thread Director supported if set. [A32_H\Ww_FEEDBACK_CHAR and IA32_HW_FEEDBACK_- 
THREAD_CONFIG MSRs are supported if set. 

Bit 24: IA32_THERM_INTERRUPT MSR bit 25 is supported if set. 

Bits 31-25: Reserved. 


EBX Bits 03-00: Number of Interrupt Thresholds in Digital Thermal Sensor. 
Bits 31-04: Reserved. 
ECX Bit OO: Hardware Coordination Feedback Capability (Presence of IA32_MPERF and IA32_APERF). The 


capability to provide a measure of delivered processor performance (since last reset of the counters), as 
a percentage of the expected processor performance when running at the TSC frequency. 

Bits 02-01: Reserved = 0. 

Bit 03: The processor supports performance-energy bias preference if CPUID.O6H:ECX.SETBH[bit 3] is set 
and it also implies the presence of a new architectural MSR called IA32_ENERGY_PERF_BIAS (1BOH). 
Bits 07-04: Reserved = 0. 

Bits 15-08: Number of Intel® Thread Director classes supported by the processor. Information for that 
many classes is written into the Intel Thread Director Table by the hardware. 

Bits 31-16: Reserved = 0. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


EDX Bits 07-00: Bitmap of supported hardware feedback interface capabilities. 

0 = When set to 1, indicates support for performance capability reporting. 

1 = When set to 1, indicates support for energy efficiency capability reporting. 

2-7 = Reserved 
Bits 11-08: Enumerates the size of the hardware feedback interface structure in number of 4 KB pages; 
add one to the return value to get the result. 
Bits 31-16: Index (starting at 0) of this logical processor’s row in the hardware feedback interface struc- 
ture. Note that on some parts the index may be same for multiple logical processors. On some parts the 
indices may not be contiguous, i.e., there may be unused rows in the hardware feedback interface struc- 
ture. 
NOTE: 
Bits O and 1 will always be set together. 


Structured Extended Feature Flags Enumeration Leaf (Initial EAX Value = O7H, ECX = 0) 


07H 


EAX Bits 31-00: Reports the maximum input value for supported leaf 7 sub-leaves. 


EBX Bit 00: FSGSBASE. Supports RDFSBASE/RDGSBASE/WRFSBASE/WRGSBASE if 1. 
Bit 01: IA32_TSC_ADJUST MSR is supported if 1. 
Bit O02: SGX. Supports Intel® Software Guard Extensions (Intel® SGX Extensions) if 1. 
Bit 03: BMI1. 
Bit 04: HLE. 
Bit 05: AVX2. Supports Intel® Advanced Vector Extensions 2 (Intel® AVX2) if 1. 
Bit 06: FDP_EXCPTN_ONLY. x87 FPU Data Pointer updated only on x87 exceptions if 1. 
Bit 07: SMEP. Supports Supervisor-Mode Execution Prevention if 1. 
Bit 08: BMI2. 
Bit 09: Supports Enhanced REP MOVSB/STOSB if 1. 
Bit 10: INVPCID. If 1, supports INVPCID instruction for system software that manages process-context 
identifiers. 
Bit 11: RTM. 
Bit 12: RDT-M. Supports Intel® Resource Director Technology (Intel? RDT) Monitoring capability if 1. 
Bit 13: Deprecates FPU CS and FPU DS values if 1. 
Bit 14: MPX. Supports Intel? Memory Protection Extensions if 1. 
Bit 15: RDT-A. Supports Intel® Resource Director Technology (Intel® RDT) Allocation capability if 1. 
Bit 16: AVX512F. 
Bit 17: AVX512DQ. 
Bit 18: RDSEED. 
Bit 19: ADX. 
Bit 20: SMAP. Supports Supervisor-Mode Access Prevention (and the CLAC/STAC instructions) if 1. 
Bit 21: AVX512_IFMA. 
Bit 22: Reserved. 
Bit 23: CLFLUSHOPT. 
Bit 24: CLWB. 
Bit 25: Intel Processor Trace. 
Bit 26: AVX512PF. (Intel? Xeon Phi™ only.) 
Bit 27: AVX512ER. (Intel® Xeon Phi™ only.) 
Bit 28: AVX512CD. 
Bit 29: SHA. supports Intel® Secure Hash Algorithm Extensions (Intel? SHA Extensions) if 1. 
Bit 30: AVX512BW. 
Bit 31: AVX512VL. 
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Initial EAX 
Value Information Provided about the Processor 


ECX Bit OO: PREFETCHWT1. (Intel? Xeon Phi™ only.) 
Bit 01: AVX512_VBMI. 
Bit O2: UMIP. Supports user-mode instruction prevention if 1. 
Bit 03: PKU. Supports protection keys for user-mode pages if 1. 
Bit 04: OSPKE. If 1, OS has set CR4.PKE to enable protection keys (and the RDPKRU/WRPKRU instruc- 
tions). 
Bit 05: WAITPKG. 
Bit O06: AVX512_VBMI2. 
Bit 07: CET_SS. Supports CET shadow stack features if 1. Processors that set this bit define bits 1:0 of the 
IA32_U_CET and IA32_S_CET MSRs. Enumerates support for the following MSRs: 
IA32_INTERRUPT_SPP_TABLE_ADDR, IA32_PL3_SSP, |[A32_PL2_SSP, I[A32_PL1_SSP, and 
IA32_PLO_SSP. 
Bit 08: GFNI. 
Bit 09: VAES. 
Bit 10: VPCLMULQDQ. 
Bit 11: AVX512_VNNI. 
Bit 12: AVX512_BITALG. 
Bits 13: TME_EN. If 1, the following MSRs are supported: |[A32_TME_CAPABILITY, IA32_TME_ACTIVATE, 
IA32_TME_EXCLUDE_MASK, and IA32_TME_EXCLUDE_BASE. 
Bit 14: AVX512_VPOPCNTDO. 
Bit 15: Reserved. 
Bit 16: LAS7. Supports 57-bit linear addresses and five-level paging if 1. 
Bits 21-17: The value of MAWAU used by the BNDLDX and BNDSTX instructions in 64-bit mode. 
Bit 22: RDPID and IA32_TSC_AUX are available if 1. 
Bit 23: KL. Supports Key Locker if 1. 
Bit 24: BUS_LOCK_DETECT. If 1, indicates support for OS bus-lock detection. 
Bit 25: CLDEMOTE. Supports cache line demote if 1. 
Bit 26: Reserved. 
Bit 27: MOVDIRI. Supports MOVDIRI if 1. 
Bit 28: MOVDIR64B. Supports MOVDIR64B if 1. 
Bit 29: ENOQCMD. Supports Enqueue Stores if 1. 
Bit 30: SGX_LC. Supports SGX Launch Configuration if 1. 
Bit 31: PKS. Supports protection keys for supervisor-mode pages if 1. 


EDX Bit 00: Reserved. 
Bit 01: SGX-KEYS. If 1, Attestation Services for Intel® SGX is supported. 
Bit 02: AVX512_4VNNIW. (Intel® Xeon Phi™ only.) 
Bit 03: AVX512_4FMAPS. (Intel® Xeon Phi™ only.) 
Bit 04: Fast Short REP MOV. 
Bit 05: UINTR. If 1, the processor supports user interrupts. 
Bits 07-06: Reserved. 
Bit 08: AVX512_VP2INTERSECT. 
Bit 09: SRBDS_CTRL. If 1, enumerates support for the [A32_MCU_OPT_CTRL MSR and indicates its bit 0 
(RNGDS_MITG_DIS) is also supported. 
Bit 10: MD_CLEAR supported. 
Bit 11: RTM_ALWAYS_ABORT. If set, any execution of XBEGIN immediately aborts and transitions to the 
specified fallback address. 
Bit 12: Reserved. 
Bit 13: If 1, RTM_FORCE_ABORT supported. Processors that set this bit support the 
IA32_TSX_FORCE_ABORT MSR. They allow software to set IA32_TSX_FORCE_ABORT[0] 
(RTM_FORCE_ABORT). 
Bit 14: SERIALIZE. 
Bit 15: Hybrid. If 1, the processor is identified as a hybrid part. If CPUID.O.MAXLEAF > 1AH and 


CPUID.1A.EAX 4 0, then the Native Model ID Enumeration Leaf 1AH exists. 
Bit 16: TSXLDTRK. If 1, the processor supports Intel TSX suspend/resume of load address tracking. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
Bit 17: Reserved. 
Bit 18: PCONFIG. Supports PCONFIG if 1. 
Bit 19: Architectural LBRs. If 1, indicates support for architectural LBRs. 
Bit 20: CET_IBT. Supports CET indirect branch tracking features if 1. Processors that set this bit define 
bits 5:2 and bits 63:10 of the IA32_U_CET and IA32_S_CET MSRs. 
Bit 21: Reserved. 
Bit 22: AMX-BF16. If 1, the processor supports tile computational operations on bfloat16 numbers. 
Bit 23: AVX512_FP16. 
Bit 24: AMX-TILE. If 1, the processor supports tile architecture. 
Bits 25: AMX-INT8. If 1, the processor supports tile computational operations on 8-bit integers. 
Bit 26: Enumerates support for indirect branch restricted speculation (IBRS) and the indirect branch pre- 
dictor barrier (IBPB). Processors that set this bit support the [A32_SPEC_CTRL MSR and the 
IA32_PRED_CMD MSR. They allow software to set IA32_SPEC_CTRL[O] (IBRS) and I[A32_PRED_CMD[O] 
(IBPB). 
Bit 27: Enumerates support for single thread indirect branch predictors (STIBP). Processors that set this 
bit support the [A32_SPEC_CTRL MSR. They allow software to set [A32_SPEC_CTRL[1] (STIBP). 
Bit 28: Enumerates support for L1D_FLUSH. Processors that set this bit support the [A32_FLUSH_CMD 
MSR. They allow software to set [A32_FLUSH_CMD[O] (L1D_FLUSH). 
Bit 29: Enumerates support for the [A32_ARCH_CAPABILITIES MSR. 
Bit 30: Enumerates support for the [A32_CORE_CAPABILITIES MSR. 
IA32_CORE_CAPABILITIES is an architectural MSR that enumerates model-specific features. A bit being 
set in this MSR indicates that a model specific feature is supported; software must still consult CPUID 
family/model/stepping to determine the behavior of the enumerated feature as features enumerated in 
IA32_CORE_CAPABILITIES may have different behavior on different processor models. Some of these 
features may have behavior that is consistent across processor models (and for which consultation of 
CPUID family/model/stepping is not necessary); such features are identified explicitly where they are 
documented in this manual. 
Bit 31: Enumerates support for Speculative Store Bypass Disable (SSBD). Processors that set this bit sup- 
port the IA32_SPEC_CTRL MSR. They allow software to set [A32_SPEC_CTRL[2] (SSBD). 
NOTE: 
* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return O. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf 0 returns in EAX. 
Structured Extended Feature Enumeration Sub-leaf (Initial EAX Value = 07H, ECX = 1) 
07H NOTES: 
Leaf 07H output depends on the initial value in ECX. 
If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. 
EAX This field reports O if the sub-leaf index, 7, is invalid. 
Bits 03-00: Reserved. 
Bit 04: AVX-VNNI. AVX (VEX-encoded) versions of the Vector Neural Network Instructions. 
Bit 05: AVX512_BF16. Vector Neural Network Instructions supporting BFLOAT16 inputs and conversion 
instructions from IEEE single precision. 
Bits 09-06: Reserved. 
Bit 10: If 1, supports fast zero-length REP MOVSB. 
Bit 11: If 1, supports fast short REP STOSB. 
Bit 12: If 1, supports fast short REP CMPSB, REP SCASB. 
Bits 21-13: Reserved. 
Bit 22: HRESET. If 1, supports history reset via the HRESET instruction and the IA32_HRESET_ENABLE 
MSR. When set, indicates that the Processor History Reset Leaf (EAX = 20H) is valid. 
Bits 29-23: Reserved. 
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Initial EAX 
Value Information Provided about the Processor 


Bit 30: INVD_DISABLE_POST_BIOS_DONE. If 1, supports INVD execution prevention after BIOS Done. 
Bit 31: Reserved. 


EBX This field reports O if the sub-leaf index, 7, is invalid. 
Bit 00: Enumerates the presence of the [A32_PPIN and IA32_PPIN_CTL MSRs. If 1, these MSRs are sup- 
ported. 
Bits 31-01: Reserved. 

ECX This field reports O if the sub-leaf index, 7, is invalid; otherwise it is reserved. 

EDX This field reports O if the sub-leaf index, 7, is invalid. 


Bits 17-00: Reserved. 

Bit 18: CET_SSS. If 1, indicates that an operating system can enable supervisor shadow stacks as long as 
it ensures that a supervisor shadow stack cannot become prematurely busy due to page faults (see Sec- 
tion 17.2.3 of the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 1). When 
emulating the CPUID instruction, a virtual-machine monitor (VMM) should return this bit as 1 only if it 
ensures that VM exits cannot cause a guest supervisor shadow stack to appear to be prematurely busy. 
Such a VMM could set the “prematurely busy shadow stack” VM-exit control and use the additional infor- 
mation that it provides. 

Bits 31-19: Reserved. 


Structured Extended Feature Enumeration Sub-leaf (Initial EAX Value = 07H, ECX = 2) 


07H NOTES: 
Leaf 07H output depends on the initial value in ECX. 
If ECX contains an invalid sub leaf index, EAX/EBX/ECX/EDX return 0. 


EAX This field reports O if the sub-leaf index, 2, is invalid; otherwise it is reserved. 
EBX This field reports O if the sub-leaf index, 2, is invalid; otherwise it is reserved. 
ECX This field reports O if the sub-leaf index, 2, is invalid; otherwise it is reserved. 
EDX This field reports O if the sub-leaf index, 2, is invalid. 


Bit 00: PSFD. If 1, indicates bit 7 of the [A32_SPEC_CTRL MSR is supported. Bit 7 of this MSR disables 
Fast Store Forwarding Predictor without disabling Speculative Store Bypass. 

Bit 01: IPRED_CTRL. If 1, indicates bits 3 and 4 of the [A32_SPEC_CTRL MSR are supported. Bit 3 of this 
MSR enables IPRED_DIS control for CPL3. Bit 4 of this MSR enables IPRED_DIS control for CPLO/1/2. 

Bit 02: RRSBA_CTRL. If 1, indicates bits 5 and 6 of the |A32_SPEC_CTRL MSR are supported. Bit 5 of this 
MSR disables RRSBA behavior for CPL3. Bit 6 of this MSR disables RRSBA behavior for CPLO/1/2. 

Bit 03: DDPD_U. If 1, indicates bit 8 of the IA32_SPEC_CTRL MSR is supported. Bit 8 of this MSR disables 
Data Dependent Prefetcher. 

Bit 04: BHI_CTRL. If 1, indicates bit 10 of the IA32_SPEC_CTRL MSR is supported. Bit 10 of this MSR 
enables BHI_DIS_S behavior. 

Bit 05: MCDT_NO. Processors that enumerate this bit as 1 do not exhibit MXCSR Configuration Depen- 
dent Timing (MCDT) behavior and do not need to be mitigated to avoid data-dependent behavior for cer- 
tain instructions. 


Bits 31-06: Reserved. 
Direct Cache Access Information Leaf (Initial EAX Value = O9H) 


09H EAX Value of bits [31:0] of IA32_PLATFORM_DCA_CAP MSR (address 1F8H). 
EBX Reserved. 
ECX Reserved. 
EDX Reserved. 
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Initial EAX 
Value 


Information Provided about the Processor 


Architectural Performance Monitoring Leaf (Initial EAX Value = OAH) 


OAH EAX 


EBX 


ECX 


EDX 


Bits 07-00: Version ID of architectural performance monitoring. 

Bits 15-08: Number of general-purpose performance monitoring counter per logical processor. 

Bits 23-16: Bit width of general-purpose, performance monitoring counter. 

Bits 31-24: Length of EBX bit vector to enumerate architectural performance monitoring events. Archi- 
tectural event x is supported if EBX[x]=0 && EAX[31:24]>x. 


Bit 00: Core cycle event not available if 1 or if EAX[31:24]<1. 

Bit 01: Instruction retired event not available if 1 or if EAX[31:24]<2. 

Bit 02: Reference cycles event not available if 1 or if EAX[31:24]<3. 

Bit 03: Last-level cache reference event not available if 1 or if EAX[31:24]<4. 
Bit 04: Last-level cache misses event not available if 1 or if EAX[31:24]<5. 
Bit 05: Branch instruction retired event not available if 1 or if EAX[31:24]<6. 
Bit O6: Branch mispredict retired event not available if 1 or if EAX[31:24]<7. 
Bit 07: Top-down slots event not available if 1 or if EAX[31:24]<8. 

Bits 31-08: Reserved = 0. 


Bits 31-00: Supported fixed counters bit mask. Fixed-function performance counter ‘i’ is supported if bit ‘’ 
is 1 (first counter index starts at zero). It is recommended to use the following logic to determine if a 
Fixed Counter is supported: FxCtr[i]_is supported := ECX{i] || (EDX[4:0] > i); 


Bits 04-00: Number of contiguous fixed-function performance counters starting from 0 (if Version ID > 
1). 
Bits 12-05: Bit width of fixed-function performance counters (if Version ID > 1). 
Bits 14-13: Reserved = 0. 

Bit 15: AnyThread deprecation. 

Bits 31-16: Reserved = 0. 


Extended Topology Enumeration Leaf (Initial EAX Value = OBH) 


OBH 


EAX 


CPUID—CPU Identification 


NOTES: 


CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence 
of Leaf 1FH before using leaf OBH. 

The sub-leaves of CPUID leaf OBH describe an ordered hierarchy of logical processors starting from the 
smallest-scoped domain of a Logical Processor (sub-leaf index 0) to the Core domain (sub-leaf index 1) 
to the largest-scoped domain (the last valid sub-leaf index) that is implicitly subordinate to the 
unenumerated highest-scoped domain of the processor package (socket). 

The details of each valid domain is enumerated by a corresponding sub-leaf. Details for a domain 
include its type and how all instances of that domain determine the number of logical processors and 
x2 APICID partitioning at the next higher-scoped domain. The ordering of domains within the hierarchy 
is fixed architecturally as shown below. For a given processor, not all domains may be relevant or 
enumerated; however, the logical processor and core domains are always enumerated. 

For two valid sub-leaves N and N+1, sub-leaf N+1 represents the next immediate higher-scoped 
domain with respect to the domain of sub-leaf N for the given processor. 

If sub-leaf index “N” returns an invalid domain type in ECX[15:08] (OOH), then all sub-leaves with an 
index greater than “N” shall also return an invalid domain type. A sub-leaf returning an invalid domain 
always returns O in EAX and EBX. 


Bits 04-00: The number of bits that the x2APIC ID must be shifted to the right to address instances of 
the next higher-scoped domain. When logical processor is not supported by the processor, the value of 
this field at the Logical Processor domain sub-leaf may be returned as either O (no allocated bits in the 
x2APIC ID) or 1 (one allocated bit in the x2APIC ID); software should plan accordingly. 

Bits 31-05: Reserved. 
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Initial EAX 
Value Information Provided about the Processor 
EBX Bits 15-00: The number of logical processors across all instances of this domain within the next higher- 
scoped domain. (For example, in a processor socket/package comprising “M” dies of “N” cores each, where 
each core has “L” logical processors, the “die” domain sub-leaf value of this field would be M*N*L.,) This 
number reflects configuration as shipped by Intel. Note, software must not use this field to enumerate 
processor topology”. 
Bits 31-16: Reserved. 
ECX Bits 07-00: The input ECX sub-leaf index. 
Bits 15-08: Domain Type. This field provides an identification value which indicates the domain as shown 
below. Although domains are ordered, their assigned identification values are not and software should 
not depend on it. 
Hierarchy Domain Domain Type Identification Value 
Lowest Logical Processor 1 
Highest Core 2 
(Note that enumeration values of 0 and 3-255 are reserved.) 
Bits 31-16: Reserved. 
EDX Bits 31-00: x2APIC ID of the current logical processor. 
NOTES: 
* Software must not use the value of EBX[15:0] to enumerate processor topology of the system. The 
value is only intended for display and diagnostic purposes. The actual number of logical processors avail- 
able to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software and 
platform hardware configurations. 
Processor Extended State Enumeration Main Leaf (Initial EAX Value = ODH, ECX = OQ) 
ODH NOTES: 


EAX 


EBX 


ECX 


EDX 


Leaf ODH main leaf (ECX = 0). 


Bits 31-00: Reports the supported bits of the lower 32 bits of XCRO. XCRO[n] can be set to 1 only if 
EAX[n] is 1. 

Bit OO: x87 state. 

Bit 01: SSE state. 

Bit 02: AVX state. 

Bits 04-03: MPX state. 

Bits 07-05: AVX-512 state. 

Bit 08: Used for IA32_XSS. 

Bit 09: PKRU state. 

Bits 16-10: Used for I[A32_XSS. 
Bit 17: TILECFG state. 

Bit 18: TILEDATA state. 

Bits 31-19: Reserved. 


Bits 31-00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) required by 
enabled features in XCRO. May be different than ECX if some features at the end of the XSAVE save area 
are not enabled. 


Bit 31-00: Maximum size (bytes, from the beginning of the XSAVE/XRSTOR save area) of the 
XSAVE/XRSTOR save area required by all supported features in the processor, i.e., all the valid bit fields in 
XCRO. 


Bit 31-00: Reports the supported bits of the upper 32 bits of XCRO. XCRO[n+32] can be set to 1 only if 
EDX[n] is 1. 
Bits 31-00: Reserved. 
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Initial EAX 
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Processor Extended State Enumeration Sub-leaf (Initial EAX Value = ODH, ECX = 1) 


ODH EAX 


EBX 


ECX 


EDX 


Bit 00: XSAVEOPT is available. 

Bit 01: Supports XSAVEC and the compacted form of XRSTOR if set. 
Bit 02: Supports XGETBV with ECX = 1 if set. 

Bit 03: Supports XSAVES/XRSTORS and IA32_XSS if set. 

Bit 04: Supports extended feature disable (XFD) if set. 

Bits 31-05: Reserved. 


Bits 31-00: The size in bytes of the XSAVE area containing all states enabled by XCRO | I[A32_XSS. 


NOTES: 

If EAX[3] is enumerated as O and EAX[1] is enumerated as 1, EBX enumerates the size of the XSAVE area 
containing all states enabled by XCRO. If EAX[1] and EAX[3] are both enumerated as 0, EBX enumerates 
zero. 


Bits 31-00: Reports the supported bits of the lower 32 bits of the IA32_XSS MSR. IA32_XSS[n] can be 
set to 1 only if ECX[n] is 1. 

Bits 07-00: Used for XCRO. 

Bit 08: PT state. 

Bit 09: Used for XCRO. 

Bit 10: PASID state. 

Bit 11: CET user state. 

Bit 12: CET supervisor state. 

Bit 13: HDC state. 

Bit 14: UINTR state. 

Bit 15: LBR state (only for the architectural LBR feature). 
Bit 16: HWP state. 

Bits 18-17: Used for XCRO. 

Bits 31-19: Reserved. 


Bits 31-00: Reports the supported bits of the upper 32 bits of the IA32_XSS MSR. IA32_XSS[n+32] can 
be set to 1 only if EDX[n] is 1. 
Bits 31-00: Reserved. 


Processor Extended State Enumeration Sub-leaves (Initial EAX Value = ODH, ECX =n, n > 1) 


ODH 


EAX 


EBX 


ECX 


NOTES: 
Leaf ODH output depends on the initial value in ECX. 
Each sub-leaf index (starting at position 2) is supported if it corresponds to a supported bit in either the 
XCRO register or the [A32_XSS MSR. 
* If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf n (0 < n < 31) is invalid 
if sub-leaf O returns O in EAX[n] and sub-leaf 1 returns O in ECX[n]. Sub-leaf n (32 <n < 63) is invalid if 
sub-leaf O returns O in EDX[n-32] and sub-leaf 1 returns O in EDX[n-32]. 


Bits 31-00: The size in bytes (from the offset specified in EBX) of the save area for an extended state 
feature associated with a valid sub-leaf index, n. 


Bits 31-00: The offset in bytes of this extended state component's save area from the beginning of the 
XSAVE/XRSTOR area. 
This field reports O if the sub-leaf index, n, does not map to a valid bit in the XCRO register*. 


Bit 00 is set if the bit n (corresponding to the sub-leaf index) is supported in the [A32_XSS MSR; it is clear 
if bit n is instead supported in XCRO. 

Bit 01 is set if, when the compacted format of an XSAVE area is used, this extended state component 
located on the next 64-byte boundary following the preceding state component (otherwise, it is located 
immediately following the preceding state component). 

Bits 31-02 are reserved. 

This field reports O if the sub-leaf index, n, is invalid*. 
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Initial EAX 
Value 


Information Provided about the Processor 


EDX This field reports O if the sub-leaf index, n, is invalid*; otherwise it is reserved. 


Intel? Resource Director Technology (Intel? RDT) Monitoring Enumeration Sub-leaf (Initial EAX Value = OFH, ECX = O) 


OFH 


NOTES: 
Leaf OFH output depends on the initial value in ECX. 
Sub-leaf index O reports valid resource type starting at bit position 1 of EDX. 
EAX Reserved. 
EBX Bits 31-00: Maximum range (zero-based) of RMID within this physical processor of all types. 
ECX Reserved. 


EDX Bit OO: Reserved. 
Bit 01: Supports L3 Cache Intel RDT Monitoring if 1. 
Bits 31-02: Reserved. 


L3 Cache Intel? RDT Monitoring Capability Enumeration Sub-leaf (Initial EAX Value = OFH, ECX = 1) 


OFH 


NOTES: 
Leaf OFH output depends on the initial value in ECX. 


EAX Bits 07-00:The counter width is encoded as an offset from 24b. A value of zero in this field indicates that 
24-bit counters are supported. A value of 8 in this field indicates that 32-bit counters are supported. 
Bit 08: If 1, indicates the presence of an overflow bit in the IA32_QM_CTR MSR (bit 61). 
Bit 09: If 1, indicates the presence of non-CPU agent Intel RDT CMT support. 
Bit 10: If 1, indicates the presence of non-CPU agent Intel RDT MBM support. 
Bits 31-11: Reserved. 


EBX Bits 31-00: Conversion factor from reported [A32_QM_CTR value to occupancy metric (bytes) and Mem- 
ory Bandwidth Monitoring (MBM) metrics. 


ECX Maximum range (zero-based) of RMID of this resource type. 


EDX Bit 00: Supports L3 occupancy monitoring if 1. 
Bit 01: Supports L3 Total Bandwidth monitoring if 1. 
Bit O2: Supports L3 Local Bandwidth monitoring if 1. 
Bits 31-03: Reserved. 


Intel? Resource Director Technology (Intel® RDT) Allocation Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = OQ) 


10H 


NOTES: 
Leaf 10H output depends on the initial value in ECX. 
Sub-leaf index O reports valid resource identification (ResID) starting at bit position 1 of EBX. 
EAX Reserved. 


EBX Bit OO: Reserved. 
Bit 01: Supports L3 Cache Allocation Technology if 1. 
Bit 02: Supports L2 Cache Allocation Technology if 1. 
Bit 03: Supports Memory Bandwidth Allocation if 1. 
Bits 31-04: Reserved. 


ECX Reserved. 
EDX Reserved. 


L3 Cache Allocation Technology Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = Res/ID =1) 


10H 


NOTES: 
Leaf 10H output depends on the initial value in ECX. 
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EAX Bits 04-00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to 
get the result. 
Bits 31-05: Reserved. 


EBX Bits 31-00: Bit-granular map of isolation/contention of allocation units. 


ECX Bit 00: Reserved. 
Bit 01: If 1, indicates L3 CAT for non-CPU agents is supported. 
Bit O2: If 1, indicates L3 Code and Data Prioritization Technology is supported. 
Bit 03: If 1, indicates non-contiguous capacity bitmask is supported. The bits that are set in the various 
IA32_L3_MASK_n registers do not have to be contiguous. 
Bits 31-04: Reserved. 


EDX Bits 15-00: Highest Class of Service (COS) number supported for this ResID. 
Bits 31-16: Reserved. 


L2 Cache Allocation Technology Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = Res/ID =2) 


10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 


EAX Bits 04-00: Length of the capacity bit mask for the corresponding ResID. Add one to the return value to 
get the result. 
Bits 31-05: Reserved. 

EBX Bits 31-00: Bit-granular map of isolation/contention of allocation units. 


ECX Bits 01-00: Reserved. 
Bit O02: CDP. If 1, indicates L2 Code and Data Prioritization Technology is supported. 
Bit 03: If 1, indicates non-contiguous capacity bitmask is supported. The bits that are set in the various 
IA32_L2_MASK_n registers do not have to be contiguous. 
Bits 31-04: Reserved. 


EDX Bits 15-00: Highest COS number supported for this ResID. 
Bits 31-16: Reserved. 


Memory Bandwidth Allocation Enumeration Sub-leaf (Initial EAX Value = 10H, ECX = ResID =3) 


10H NOTES: 
Leaf 10H output depends on the initial value in ECX. 


EAX Bits 11-00: Reports the maximum MBA throttling value supported for the corresponding ResID. Add one 
to the return value to get the result. 
Bits 31-12: Reserved. 


EBX Bits 31-00: Reserved. 


ECX Bits 01-00: Reserved. 
Bit 02: Reports whether the response of the delay values is linear. 
Bits 31-03: Reserved. 


EDX Bits 15-00: Highest COS number supported for this ResID. 
Bits 31-16: Reserved. 


Intel® SGX Capability Enumeration Leaf, Sub-leaf 0 (Initial EAX Value = 12H, ECX = 0) 


12H NOTES: 
Leaf 12H sub-leaf 0 (ECX = 0) is supported if CPUID.(EAX=07H, ECX=OH):EBX[SGX] = 1. 
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Value 


Information Provided about the Processor 


EAX Bit 00: SGX1. If 1, Indicates Intel SGX supports the collection of SGX1 leaf functions. 
Bit 01: SGX2. If 1, Indicates Intel SGX supports the collection of SGX2 leaf functions. 
Bits 04-02: Reserved. 
Bit 05: If 1, indicates Intel SGX supports ENCLV instruction leaves EINCVIRTCHILD, EDECVIRTCHILD, and 
ESETCONTEXT. 
Bit 06: If 1, indicates Intel SGX supports ENCLS instruction leaves ETRACKC, ERDINFO, ELDBC, and ELDUC. 
Bit 07: If 1, indicates Intel SGX supports ENCLU instruction leaf EVERIFYREPORT2. 
Bits 09-08: Reserved. 
Bit 10: If 1, indicates Intel SGX supports ENCLS instruction leaf EUPDATESVN. 
Bit 11: If 1, indicates Intel SGX supports ENCLU instruction leaf EDECCSSA. 
Bits 31-12: Reserved. 


EBX Bits 31-00: MISCSELECT. Bit vector of supported extended SGX features. 
ECX Bits 31-00: Reserved. 


EDX Bits 07-00: MaxEnclaveSize_Not64. The maximum supported enclave size in non-64-bit mode is 
2°(EDX[7:0)). 
Bits 15-08: MaxEnclaveSize_64. The maximum supported enclave size in 64-bit mode is 2*(EDX[15:8)). 
Bits 31-16: Reserved. 


Intel SGX Attributes Enumeration Leaf, Sub-leaf 1 (Initial EAX Value = 12H, ECX = 1) 


12H 


NOTES: 
Leaf 12H sub-leaf 1 (ECX = 1) is supported if CPUID.(EAX=07H, ECX=0H):EBX[SGX] = 1. 


EAX Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[31:0] that software can set with ECREATE. 
EBX Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[63:32] that software can set with ECREATE. 
ECX Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[95:64] that software can set with ECREATE. 
EDX Bit 31-00: Reports the valid bits of SECS.ATTRIBUTES[1 27:96] that software can set with ECREATE. 


Intel? SGX EPC Enumeration Leaf, Sub-leaves (Initial EAX Value = 12H, ECX = 2 or higher) 


12H 
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NOTES: 
Leaf 12H sub-leaf 2 or higher (ECX >= 2) is supported if CPUID.(EAX=07H, ECX=OH):EBX[SGX] = 1. 
For sub-leaves (ECX = 2 or higher), definition of EDX,ECX,EBX,EAX[31:4] depends on the sub-leaf type 
listed below. 


EAX Bit 03-00: Sub-leaf Type 
0000b: Indicates this sub-leaf is invalid. 
0001b: This sub-leaf enumerates an EPC section. EBX:EAX and EDX:ECX provide information on the 
Enclave Page Cache (EPC) section. 
All other type encodings are reserved. 


Type OOOO. This sub-leaf is invalid. 
EDX:ECX:EBX:EAX return 0. 
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Initial EAX 
Value 


Information Provided about the Processor 


Type 


0001b. This sub-leaf enumerates an EPC sections with EDX:ECX, EBX:EAX defined as follows. 


EAX[1 1:04]: Reserved (enumerate 0). 
EAX[31:12]: Bits 31:12 of the physical address of the base of the EPC section. 


EBX[19:00}: Bits 51:32 of the physical address of the base of the EPC section. 
EBX[31:20]: Reserved. 


ECX[03:00]: EPC section property encoding defined as follows: 
If ECX[3:0] = 0000, then all bits of the EDX:ECX pair are enumerated as O. 
If ECX[3:0] = 0001b, then this section has confidentiality and integrity protection. 
If ECX[3:0] = 0010b, then this section has confidentiality protection only. 
All other encodings are reserved. 
ECX[1 1:04]: Reserved (enumerate 0). 
ECX[31:12]: Bits 31:12 of the size of the corresponding EPC section within the Processor Reserved 
Memory. 


EDX[19:00]: Bits 51:32 of the size of the corresponding EPC section within the Processor Reserved 
Memory. 
EDX[31:20]: Reserved. 


Intel® Processor Trace Enumeration Main Leaf (Initial EAX Value = 14H, ECX = 0) 


14H 


EAX 
EBX 


ECX 


EDX 


NOTES: 
Leaf 14H main leaf (ECX = 0). 


Bits 31-00: Reports the maximum sub-leaf supported in leaf 14H. 


Bit 00: If 1, indicates that IA32_RTIT_CTL.CR3Filter can be set to 1, and that [A32_RTIT_CR3_MATCH 
MSR can be accessed. 

Bit 01: If 1, indicates support of Configurable PSB and Cycle-Accurate Mode. 

Bit O2: If 1, indicates support of IP Filtering, TraceStop filtering, and preservation of Intel PT MSRs across 
warm reset. 

Bit 03: If 1, indicates support of MTC timing packet and suppression of COFI-based packets. 

Bit 04: If 1, indicates support of PTWRITE. Writes can set IA32_RTIT_CTL[1 2] (PTWEn) and 
IA32_RTIT_CTL[5] (FUPonPTW), and PTWRITE can generate packets. 

Bit O05: If 1, indicates support of Power Event Trace. Writes can set IA32_RTIT_CTL[4] (PwrEvtEn), 
enabling Power Event Trace packet generation. 

Bit O6: If 1, indicates support for PSB and PMI preservation. Writes can set IA32_RTIT_CTL[56] (InjectPsb- 
PmiOn€nable), enabling the processor to set [A32_RTIT_STATUS[7] (PendTopaPMI) and/or |A32_R- 
TIT_STATUS[6] (PendPSB) in order to preserve ToPA PMls and/or PSBs otherwise lost due to Intel PT 
disable. Writes can also set PendToPAPMI and PendPSB. 


Bit 07: If 1, writes can set IA32_RTIT_CTL[31] (EventEn), enabling Event Trace packet generation. 
Bit 08: If 1, writes can set [A32_RTIT_CTL[55] (DisTNT), disabling TNT packet generation. 
Bit 31-09: Reserved. 


Bit OO: If 1, Tracing can be enabled with IA32_RTIT_CTL.ToPA = 1, hence utilizing the ToPA output 
scheme; |A32_RTIT_OUTPUT_BASE and IA32_RTIT_OUTPUT_MASK_PTRS MSRs can be accessed. 

Bit 01: If 1, ToPA tables can hold any number of output entries, up to the maximum allowed by the 
MaskOrTableOffset field of [A32_RTIT_OUTPUT_MASK_PTRS. 

Bit O2: If 1, indicates support of Single-Range Output scheme. 

Bit 03: If 1, indicates support of output to Trace Transport subsystem. 

Bit 30-04: Reserved. 

Bit 31: If 1, generated packets which contain IP payloads have LIP values, which include the CS base com- 
ponent. 


Bits 31-00: Reserved. 
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Intel? Processor Trace Enumeration Sub-leaf (Initial EAX Value = 14H, ECX = 7) 


14H 


EAX 


EBX 


ECX 
EDX 


Bits 02-00: Number of configurable Address Ranges for filtering. 
Bits 15-03: Reserved. 
Bits 31-16: Bitmap of supported MTC period encodings. 


Bits 15-00: Bitmap of supported Cycle Threshold value encodings. 
Bit 31-16: Bitmap of supported Configurable PSB frequency encodings. 


Bits 31-00: Reserved. 
Bits 31-00: Reserved. 


Time Stamp Counter and Nominal Core Crystal Clock Information Leaf (Initial EAX Value = 15H) 


15H 


EAX 
EBX 
ECX 
EDX 


NOTES: 
If EBX[31:0] is 0, the TSC/“core crystal clock” ratio is not enumerated. 
EBX[31:0]/EAX[31:0] indicates the ratio of the TSC frequency and the core crystal clock frequency. 
If ECX is O, the nominal core crystal clock frequency is not enumerated. 
“TSC frequency” = “core crystal clock frequency” * EBX/EAX. 
The core crystal clock may differ from the reference clock, bus clock, or core clock frequencies. 
Bits 31-00: An unsigned integer which is the denominator of the TSC/"core crystal clock” ratio. 
Bits 31-00: An unsigned integer which is the numerator of the TSC/"core crystal clock” ratio. 
Bits 31-00: An unsigned integer which is the nominal frequency of the core crystal clock in Hz. 


Bits 31-00: Reserved = 0. 


16H 


Processor Frequency Information Leaf (Initial EAX Value = 16H) 


EAX 


EBX 


ECX 


EDX 


Bits 15-00: Processor Base Frequency (in MHZ). 
Bits 31-16: Reserved =0. 


Bits 15-00: Maximum Frequency (in MHz). 
Bits 31-16: Reserved = 0. 


Bits 15-00: Bus (Reference) Frequency (in MHz). 
Bits 31-16: Reserved = 0. 


Reserved. 


NOTES: 

* Data is returned from this interface in accordance with the processor's specification and does not reflect 
actual values. Suitable use of this data includes the display of processor information in like manner to the 
processor brand string and for determining the appropriate range to use when displaying processor 
information e.g. frequency history graphs. The returned information should not be used for any other 
purpose as the returned information does not accurately correlate to information / counters returned by 
other processor interfaces. 


While a processor may support the Processor Frequency Information leaf, fields that return a value of 
zero are not supported. 


17H 


System-On-Chip Vendor Attribute Enumeration Main Leaf (Initial EAX Value = 17H, ECX = 0) 


NOTES: 
Leaf 17H main leaf (ECX = 0). 
Leaf 17H output depends on the initial value in ECX. 
Leaf 17H sub-leaves 1 through 3 reports SOC Vendor Brand String. 
Leaf 17H is valid if MaxSOCID_Index >= 3. 
Leaf 17H sub-leaves 4 and above are reserved. 
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EAX Bits 31-00: MaxSOCID_Index. Reports the maximum input value of supported sub-leaf in leaf 17H. 


EBX Bits 15-00: SOC Vendor ID. 
Bit 16: IsVendorScheme. If 1, the SOC Vendor ID field is assigned via an industry standard enumeration 
scheme. Otherwise, the SOC Vendor ID field is assigned by Intel. 
Bits 31-17: Reserved = 0. 


ECX Bits 31-00: Project ID. A unique number an SOC vendor assigns to its SOC projects. 
EDX Bits 31-00: Stepping ID. A unique number within an SOC project that an SOC vendor assigns. 
System-On-Chip Vendor Attribute Enumeration Sub-leaf (Initial EAX Value = 17H, ECX = 1..3) 
17H EAX Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string. 
EBX Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string. 
ECX Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string. 
EDX Bit 31-00: SOC Vendor Brand String. UTF-8 encoded string. 
NOTES: 
Leaf 17H output depends on the initial value in ECX. 
SOC Vendor Brand String is a UTF-8 encoded string padded with trailing bytes of OOH. 
The complete SOC Vendor Brand String is constructed by concatenating in ascending order of 
EAX:EBX:ECX:EDX and from the sub-leaf 1 fragment towards sub-leaf 3. 
System-On-Chip Vendor Attribute Enumeration Sub-leaves (Initial EAX Value = 17H, ECX > MaxSOCID_Index) 
17H NOTES: 
Leaf 17H output depends on the initial value in ECX. 
EAX Bits 31-00: Reserved = 0. 
EBX Bits 31-00: Reserved = 0. 
ECX Bits 31-00: Reserved = 0. 
EDX Bits 31-00: Reserved = 0. 
Deterministic Address Translation Parameters Main Leaf (Initial EAX Value = 18H, ECX = O) 
18H NOTES: 


Each sub-leaf enumerates a different address translation structure. 


If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return 0. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf 0 returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns O. 
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be ina 
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc- 
ture. 

* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches. 
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an 
instruction fetch). See the Intel® 64 and IA-32 Architectures Optimization Reference Manual for details 
of a particular product. 


** {Add one to the return value to get the result. 


EAX Bits 31-00: Reports the maximum input value of supported sub-leaf in leaf 18H. 
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EBX Bit 00: 4K page size entries supported by this structure. 
Bit 01: 2MB page size entries supported by this structure. 
Bit 02: 4MB page size entries supported by this structure. 
Bit 03: 1 GB page size entries supported by this structure. 
Bits 07-04: Reserved. 
Bits 10-08: Partitioning (0: Soft partitioning between the logical processors sharing this structure). 
Bits 15-11: Reserved. 
Bits 31-16: W = Ways of associativity. 


ECX Bits 31-00: S = Number of Sets. 


EDX Bits 04-00: Translation cache type field. 
OOOOOb: Null (indicates this sub-leaf is not valid). 
00001b: Data TLB. 
0001 0b: Instruction TLB. 
0001 1b: Unified TLB*. 
00100b: Load Only TLB. Hit on loads; fills on both loads and stores. 
00101b: Store Only TLB. Hit on stores; fill on stores. 
All other encodings are reserved. 
Bits 07-05: Translation cache level (starts at 1). 
Bit 08: Fully associative structure. 
Bits 13-09: Reserved. 
Bits 25-14: Maximum number of addressable IDs for logical processors sharing this translation cache.** 
Bits 31-26: Reserved. 


Deterministic Address Translation Parameters Sub-leaf (Initial EAX Value = 18H, ECX > 7) 


18H NOTES: 

Each sub-leaf enumerates a different address translation structure. 

If ECX contains an invalid sub-leaf index, EAX/EBX/ECX/EDX return O. Sub-leaf index n is invalid if n 
exceeds the value that sub-leaf O returns in EAX. A sub-leaf index is also invalid if EDX[4:0] returns O. 
Valid sub-leaves do not need to be contiguous or in any particular order. A valid sub-leaf may be ina 
higher input ECX value than an invalid sub-leaf or than a valid sub-leaf of a higher or lower-level struc- 
ture. 

* Some unified TLBs will allow a single TLB entry to satisfy data read/write and instruction fetches. 
Others will require separate entries (e.g., one loaded on data read/write and another loaded on an 
instruction fetch. See the Intel® 64 and IA-32 Architectures Optimization Reference Manual for details 
of a particular product. 


** {dd one to the return value to get the result. 
EAX Bits 31-00: Reserved. 


EBX Bit 00: 4K page size entries supported by this structure. 
Bit 01: 2MB page size entries supported by this structure. 
Bit 02: 4MB page size entries supported by this structure. 
Bit 03: 1 GB page size entries supported by this structure. 
Bits 07-04: Reserved. 
Bits 10-08: Partitioning (0: Soft partitioning between the logical processors sharing this structure). 
Bits 15-11: Reserved. 
Bits 31-16: W = Ways of associativity. 


ECX Bits 31-00: S = Number of Sets. 
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EDX Bits 04-00: Translation cache type field. 
OOOOb: Null (indicates this sub-leaf is not valid). 
0001b: Data TLB. 
0010b: Instruction TLB. 
001 1b: Unified TLB*. 
All other encodings are reserved. 
Bits 07-05: Translation cache level (starts at 1). 
Bit 08: Fully associative structure. 
Bits 13-09: Reserved. 
Bits 25-14: Maximum number of addressable IDs for logical processors sharing this translation cache** 
Bits 31-26: Reserved. 
Key Locker Leaf (Initial EAX Value = 19H) 
19H EAX Bit 00: Key Locker restriction of CPLO-only supported. 
Bit 01: Key Locker restriction of no-encrypt supported. 
Bit 02: Key Locker restriction of no-decrypt supported. 
Bits 31-03: Reserved. 
EBX Bit 00: AESKLE. If 1, the AES Key Locker instructions are fully enabled. 
Bit 01: Reserved. 
Bit O2: If 1, the AES wide Key Locker instructions are supported. 
Bit 03: Reserved. 
Bit 04: If 1, the platform supports the Key Locker MSRs (IA32_COPY_LOCAL_TO_PLATFORM, 
IA23_COPY_PLATFORM_TO_LOCAL,|IA32_COPY_STATUS, andIA32_IWKEYBACKUP_STATUS) and backing 
up the internal wrapping key. 
Bits 31-05: Reserved. 
ECX Bit OO: If 1, the NoBackup parameter to LOADIWKEY is supported. 
Bit 01: If 1, KeySource encoding of 1 (randomization of the internal wrapping key) is supported. 
Bits 31-02: Reserved. 
EDX Reserved. 
Native Model ID Enumeration Leaf (Initial EAX Value = 1AH, ECX = 0) 
1AH NOTES: 
This leaf exists on all hybrid parts, however this leaf is not only available on hybrid parts. The following 
algorithm is used for detection of this leaf: 
If CPUID.O.MMAXLEAF > 1AH and CPUID.1A.EAX 4 0, then the leaf exists. 
EAX Enumerates the native model ID and core type. 
Bits 31-24: Core type* 
10H: Reserved 
20H: Intel Atom® 
30H: Reserved 
40H: Intel® Core™ 
Bits 23-00: Native model ID of the core. The core-type and native model ID can be used to uniquely 
identify the microarchitecture of the core. This native model ID is not unique across core types, and not 
related to the model ID reported in CPUID leaf 01H, and does not identify the SOC. 
* The core type may only be used as an identification of the microarchitecture for this logical processor 
and its numeric value has no significance, neither large nor small. This field neither implies nor expresses 
any other attribute to this logical processor and software should not assume any. 
EBX Reserved. 
ECX Reserved. 
EDX Reserved. 


CPUID—CPU Identification 


Vol.2A 3-235 


INSTRUCTION SET REFERENCE, A-L 


Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
PCONFIG Information Sub-leaf (Initial EAX Value = 1BH, ECX > O) 
1BH For details on this sub-leaf, see “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-253. 
NOTE: 
Leaf 1BH is supported if CPUID.(EAX=07H, ECX=0H):EDX[1 8] = 1. 
Last Branch Records Information Leaf (Initial EAX Value = 1CH) 
1CH NOTE: 
This leaf pertains to the architectural feature. 
EAX Bits 07-00: Supported LBR Depth Values. For each bit n set in this field, the [A32_LBR_DEPTH.DEPTH 
value 8*(n+1) is supported. 
Bits 29-08: Reserved. 
Bit 30: Deep C-state Reset. If set, indicates that LBRs may be cleared on an MWAIT that requests a C-state 
numerically greater than C1. 
Bit 31: IP Values Contain LIP. If set, LBR IP values contain LIP. If clear, IP values contain Effective IP. 
EBX Bit 00: CPL Filtering Supported. If set, the processor supports setting [A32_LBR_CTL[2:1] to non-zero 
value. 
Bit 01: Branch Filtering Supported. If set, the processor supports setting IA32_LBR_CTL[22:16] to non- 
zero value. 
Bit O2: Call-stack Mode Supported. If set, the processor supports setting [A32_LBR_CTL[3] to 1. 
Bits 31-03: Reserved. 
ECX Bit 00: Mispredict Bit Supported. IA32_LBR_x_INFO[63] holds indication of branch misprediction 
(MISPRED). 
Bit 01: Timed LBRs Supported. [A32_LBR_x_INFO[15:0] holds CPU cycles since last LBR entry (CYC_CNT), 
and IA32_LBR_x_INFO[60] holds an indication of whether the value held there is valid (CYC_CNT_VALID). 
Bit O2: Branch Type Field Supported. |[A32_LBR_INFO_x[59:56] holds indication of the recorded 
operation's branch type (BR_TYPE). 
Bits 31-03: Reserved. 
EDX Bits 31-00: Reserved. 
Tile Information Main Leaf (Initial EAX Value = 1DH, ECX = 0) 
1DH NOTES: 
For sub-leaves of 1DH, they are indexed by the palette id. 
Leaf 1DH sub-leaves 2 and above are reserved. 
EAX Bits 31-00: max_palette. Highest numbered palette sub-leaf. Value = 1. 
EBX Bits 31-00: Reserved = 0. 
ECX Bits 31-00: Reserved = 0. 
EDX Bits 31-00: Reserved = 0. 
Tile Palette 1 Sub-leaf (Initial EAX Value = 1DH, ECX = 1) 
1DH EAX Bits 15-00: Palette 1 total_tile_bytes. Value = 8192. 
Bits 31-16: Palette 1 bytes_per_tile. Value = 1024. 
EBX Bits 15-00: Palette 1 bytes_per_row. Value = 64. 
Bits 31-16: Palette 1 max_names (number of tile registers). Value = 8. 
ECX Bits 15-00: Palette 1 max_rows. Value = 16. 
Bits 31-16: Reserved = 0. 
EDX Bits 31-00: Reserved = 0. 
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TMUL Information Main Leaf (Initial EAX Value = 1EH, ECX = 0) 
1E€H NOTE: 
Leaf 1€H sub-leaves 1 and above are reserved. 
EAX Bits 31-00: Reserved = 0. 
EBX Bits 07-00: tmul_maxk (rows or columns). Value = 16. 
Bits 23-08: tmul_maxn (column bytes). Value = 64. 
Bits 31-24: Reserved = 0. 
ECX Bits 31-00: Reserved = 0. 
EDX Bits 31-00: Reserved = 0. 
V2 Extended Topology Enumeration Leaf (Initial EAX Value = 1FH) 
1FH NOTES: 


CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends using leaf 1FH when available 
rather than leaf OBH and ensuring that any leaf OBH algorithms are updated to support leaf 1FH. 
The sub-leaves of CPUID leaf 1FH describe an ordered hierarchy of logical processors starting from the 
smallest-scoped domain of a Logical Processor (sub-leaf index 0) to the Core domain (sub-leaf index 1) 
to the largest-scoped domain (the last valid sub-leaf index) that is implicitly subordinate to the 
unenumerated highest-scoped domain of the processor package (socket). 

The details of each valid domain is enumerated by a corresponding sub-leaf. Details for a domain 
include its type and how all instances of that domain determine the number of logical processors and 
x2 APICID partitioning at the next higher-scoped domain. The ordering of domains within the hierarchy 
is fixed architecturally as shown below. For a given processor, not all domains may be relevant or 
enumerated; however, the logical processor and core domains are always enumerated. As an example, 
a processor may report an ordered hierarchy consisting only of “Logical Processor,” “Core,” and “Die.” 
For two valid sub-leaves N and N+1, sub-leaf N+1 represents the next immediate higher-scoped 
domain with respect to the domain of sub-leaf N for the given processor. 

If sub-leaf index “N” returns an invalid domain type in ECX[15:08] (OOH), then all sub-leaves with an 
index greater than “N” shall also return an invalid domain type. A sub-leaf returning an invalid domain 
always returns O in EAX and EBX. 


EAX Bits 04-00: The number of bits that the x2APIC ID must be shifted to the right to address instances of 
the next higher-scoped domain. When logical processor is not supported by the processor, the value of 
this field at the Logical Processor domain sub-leaf may be returned as either 0 (no allocated bits in the 
x2APIC ID) or 1 (one allocated bit in the x2APIC ID); software should plan accordingly. 

Bits 31-05: Reserved. 


EBX Bits 15-00: The number of logical processors across all instances of this domain within the next higher- 
scoped domain relative to this current logical processor. (For example, in a processor socket/package 
comprising “M” dies of “N” cores each, where each core has “L” logical processors, the “die” domain sub- 
leaf value of this field would be M*N*L. In an asymmetric topology this would be the summation of the 
value across the lower domain level instances to create each upper domain level instance.) This number 
reflects configuration as shipped by Intel. Note, software must not use this field to enumerate processor 
topology*. 

Bits 31-16: Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value 


Information Provided about the Processor 


ECX 


EDX 


Bits 07-00: The input ECX sub-leaf index. 

Bits 15-08: Domain Type. This field provides an identification value which indicates the domain as shown 
below. Although domains are ordered, as also shown below, their assigned identification values are not 
and software should not depend on it. (For example, if anew domain between core and module is speci- 
fied, it will have an identification value higher than 5.) 


Hierarchy Domain Domain Type Identification Value 
Lowest Logical Processor 1 
Core 2 
Module 3 
Tile 4 
5 
6 


Die 
o DieGrp 
Highest Package/Socket 


(Note that enumeration values of O and 7-255 are reserved. 


(implied) 
) 


Bits 31-16: Reserved. 


Bits 31-00: x2APIC ID of the current logical processor. It is always valid and does not vary with the sub- 
leaf index in ECX. 


NOTES: 

* Software must not use the value of EBX[15:0] to enumerate processor topology of the system. The 
value is only intended for display and diagnostic purposes. The actual number of logical processors avail- 
able to BIOS/OS/Applications may be different from the value of EBX[15:0], depending on software and 
platform hardware configurations. 


Processor History Reset Sub-leaf (Initial EAX Value = 20H, ECX = Q) 


20H 


EAX 
EBX 


ECX 
EDX 


Reports the maximum number of sub-leaves that are supported in leaf 20H. 


Indicates which bits may be set in the [A32_HRESET_ENABLE MSR to enable reset of different compo- 
nents of hardware-maintained history. 

Bit 00: Indicates support for both HRESET’s EAX[0] parameter, and IA32_HRESET_ENABLE[O] set by the 
OS to enable reset of Intel® Thread Director history. 

Bits 31-01: Reserved = 0. 


Reserved. 


Reserved. 


Unimplemented CPUID Leaf Functions 


21H 


Invalid. No existing or future CPU will return processor identification or feature information if the initial 
EAX value is 21H. If the value returned by CPUID.O:EAX (the maximum input value for basic CPUID 
information) is at least 21H, O is returned in the registers EAX, EBX, ECX, and EDX. Otherwise, the data 
for the highest basic information leaf is returned. 


40000000H 


A4FFFFFFFH 


Invalid. No existing or future CPU will return processor identification or feature information if the initial 
EAX value is in the range 40000000H to 4FFFFFFFH. 


Extended Function CPUID Information 


80000000H 


EAX 
EBX 
ECX 
EDX 


Maximum Input Value for Extended Function CPUID Information. 
Reserved. 


Reserved. 


Reserved. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
80000001H | EAX Extended Processor Signature and Feature Bits. 
EBX Reserved. 
ECX Bit OO: LAHF/SAHF available in 64-bit mode.* 
Bits 04-01: Reserved. 
Bit 05: LZCNT. 
Bits 07-06: Reserved. 
Bit 08: PREFETCHW. 
Bits 31-09: Reserved. 
EDX Bits 10-00: Reserved. 
Bit 11: SYSCALL/SYSRET.** 
Bits 19-12: Reserved = 0. 
Bit 20: Execute Disable Bit available. 
Bits 25-21: Reserved = 0. 
Bit 26: 1-GByte pages are available if 1. 
Bit 27: RDTSCP and |A32_TSC_AUX are available if 1. 
Bit 28: Reserved = 0. 
Bit 29: Intel® 64 Architecture available if 1. 
Bits 31-30: Reserved = 0. 
NOTES: 
* LAHF and SAHF are always available in other modes, regardless of the enumeration of this feature flag. 
** Intel processors support SYSCALL and SYSRET only in 64-bit mode. This feature flag is always enumer- 
ated as 0 outside 64-bit mode. 
80000002H | EAX Processor Brand String. 
EBX Processor Brand String Continued. 
ECX Processor Brand String Continued. 
EDX Processor Brand String Continued. 
80000003H | EAX Processor Brand String Continued. 
EBX Processor Brand String Continued. 
ECX Processor Brand String Continued. 
EDX Processor Brand String Continued. 
80000004H | EAX Processor Brand String Continued. 
EBX Processor Brand String Continued. 
ECX Processor Brand String Continued. 
EDX Processor Brand String Continued. 
80000005H | EAX Reserved = 0. 
EBX Reserved = 0. 
ECX Reserved = 0. 
EDX Reserved = 0. 
80000006H | EAX Reserved = 0. 
EBX Reserved = 0. 
ECX Bits 07-00: Cache Line size in bytes. 
Bits 11-08: Reserved. 
Bits 15-12: L2 Associativity field *. 
Bits 31-16: Cache size in 1K units. 
EDX Reserved = 0. 
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Table 3-8. Information Returned by CPUID Instruction (Contd.) 


Initial EAX 
Value Information Provided about the Processor 
NOTES: 
* L2 associativity field encodings: 
OOH - Disabled O8H - 16 ways 
01H - 1 way (direct mapped) OSH - Reserved 
02H - 2 ways OAH - 32 ways 
O3H - Reserved OBH - 48 ways 
O4H - 4 ways OCH - 64 ways 
O5H - Reserved ODH - 96 ways 
O6H - 8 ways OEH - 128 ways 
07H - See CPUID leaf 04H, sub-leaf 2** OFH - Fully associative 
** CPUID leaf 04H provides details of deterministic cache parameters, including the L2 cache in sub-leaf 2 
80000007H | EAX Reserved = 0. 
EBX Reserved = 0. 
ECX Reserved = 0. 
EDX Bits 07-00: Reserved = 0. 


Bit 08: Invariant TSC available if 1. 
Bits 31-09: Reserved = 0. 


80000008H | EAX Linear/Physical Address size. 

Bits 07-00: #Physical Address Bits*. 
Bits 15-08: #Linear Address Bits. 
Bits 31-16: Reserved = 0. 


EBX Bits 08-00: Reserved = 0. 
Bit 09: WBNOINVD is available if 1. 
Bits 31-10: Reserved = 0. 


ECX Reserved = 0. 
EDX Reserved = 0. 
NOTES: 


* |f CPUID.BO000008H:EAX[7:0] is supported, the maximum physical address number supported should 
come from this field. If TME-MK is enabled, the number of bits that can be used to address physical 
memory is CPUID.B0000008H:EAX[7:0] - IA32_TME_ACTIVATE[35:32]. 


INPUT EAX = 0: Returns CPUID’s Highest Value for Basic Processor Information and the Vendor Identification String 


When CPUID executes with EAX set to 0, the processor returns the highest value the CPUID recognizes for 
returning basic processor information. The value is returned in the EAX register and is processor specific. 


A vendor identification string is also returned in EBX, EDX, and ECX. For Intel processors, the string is “Genu- 
ineIntel” and is expressed: 

EBX := 756e6547h (* “Genu", with G in the low eight bits of BL *) 

EDX := 49656e69h (* “inel”, with i in the low eight bits of DL *) 

ECX := 6c65746eh (* “ntel”, with n in the low eight bits of CL *) 


INPUT EAX = 80000000H: Returns CPUID’s Highest Value for Extended Processor Information 


When CPUID executes with EAX set to 80000000H, the processor returns the highest value the processor recog- 
nizes for returning extended processor information. The value is returned in the EAX register and is processor 
specific. 


IA32_BIOS_SIGN_ID Returns Microcode Update Signature 


For processors that support the microcode update facility, the IA32_BIOS_SIGN_ID MSR is loaded with the update 
signature whenever CPUID executes. The signature is returned in the upper DWORD. For details, see Chapter 10 in 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 
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INPUT EAX = 01H: Returns Model, Family, Stepping Information 


When CPUID executes with EAX set to 01H, version information is returned in EAX (see Figure 3-6). For example: 
model, family, and processor type for the Intel Xeon processor 5100 series is as follows: 


° Model — 1111B 

¢ Family — 0101B 

¢ Processor Type — 00B 

See Table 3-9 for available processor type values. Stepping IDs are provided as needed. 


31 28 27 20 19 16 15 14 13 12 11 8 


7 4 3 0 
Extended Extended Stepping 
aie Family ID Model ID 


Extended Family ID (0) 


Extended Model ID (0) 
Processor Type 
Family (OFH for the Pentium 4 Processor Family) 


Model 
Reserved 
OM16525 
Figure 3-6. Version Information Returned by CPUID in EAX 
Table 3-9. Processor Type Field 
Type Encoding 
Original OEM Processor OOB 
Intel OverDrive Processor 01B 
Dual processor (not applicable to Intel486 processors) 10B 
Intel reserved 11B 


NOTE 


See Chapter 20 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, 
for information on identifying earlier IA-32 processors. 


The Extended Family ID needs to be examined only when the Family ID is OFH. Integrate the fields into a display 
using the following rule: 


IF Family_ID # OFH 

THEN DisplayFamily = Family_ID; 

ELSE DisplayFamily = Extended_Family_ID + Family_ID; 
Fl; 
(* Show DisplayFamily as HEX field. *) 
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The Extended Model ID needs to be examined only when the Family ID is O6H or OFH. Integrate the field into a 
display using the following rule: 


IF (Family_ID = O6H or Family_ID = OFH) 
THEN DisplayModel = (Extended_Model_ID « 4) + Model_ID; 
(* Right justify and zero-extend 4-bit field; display Model_ID as HEX field.*) 
ELSE DisplayModel = Model_ID; 

Fl; 

(* Show DisplayModel as HEX field. *) 


INPUT EAX = 01H: Returns Additional Information in EBX 
When CPUID executes with EAX set to 01H, additional information is returned to the EBX register: 


¢ Brand index (low byte of EBX) — this number provides an entry into a brand string table that contains brand 
strings for IA-32 processors. More information about this field is provided later in this section. 


* CLFLUSH instruction cache line size (second byte of EBX) — this number indicates the size of the cache line 
flushed by the CLFLUSH and CLFLUSHOPT instructions in 8-byte increments. This field was introduced in the 
Pentium 4 processor. 


* Local APIC ID (high byte of EBX) — this number is the 8-bit ID that is assigned to the local APIC on the 
processor during power up. This field was introduced in the Pentium 4 processor. 


INPUT EAX = 01H: Returns Feature Information in ECX and EDX 

When CPUID executes with EAX set to 01H, feature information is returned in ECX and EDX. 

¢ Figure 3-7 and Table 3-10 show encodings for ECX. 

° Figure 3-8 and Table 3-11 show encodings for EDX. 

For all feature flags, a 1 indicates that the feature is supported. Use Intel to properly interpret feature flags. 


NOTE 


Software must confirm that a processor feature is present using feature flags returned by CPUID 
prior to using the feature. Software should not depend on future offerings retaining all features. 
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RDRAND 
F16C 


31 30 29 28 27 26 25 24 23 22 21 2019181716 1514131211109 8 7654321 0 


AVX 
OSXSAVE 
XSAVE 


AES 


TSC-Deadline 
POPCNT 


MOVBE 


x2APIC 


DCA — Direc 
PCID — Proc 


xTPR Update 


SSE4_2— SSE4.2 
SSE4_1— SSE4.1 
PDCM — Perf/Debug Capability MSR 


CMPXCHG16B 
FMA — Fused Multiply Add 


t Cache Access 
ess-context Identifiers 


Control 


SDBG 
CNXT-ID —L 


SMX — Safer 


MONITOR — 


Reserved 


SSSE3 — SSSE3 Extensions 
TM2 — Thermal Monitor 2 
EIST — Enhanced Intel SpeedStep® Technology 


VMX — Virtual Machine Extensions 
DS-CPL — CPL Qualified Debug Store 


DTES64 — 64-bit DS Area 
PCLMULQDQ — Carryless Multiplication 
SSE3 — SSE3 Extensions 


1 Context ID 


Mode Extensions 


MONITOR/MWAIT 


OM16524b 


Figure 3-7. Feature Information Returned in the ECX Register 


Table 3-10. Feature Information Returned in the ECX Register 


Bit # Mnemonic Description 
SSE3 Streaming SIMD Extensions 3 (SSE3). A value of 1 indicates the processor supports this 

technology. 

1 PCLMULQDQ PCLMULQDQ. A value of 1 indicates the processor supports the PCLMULQDQ instruction. 

2 DTES64 64-bit DS Area. A value of 1 indicates the processor supports DS area using 64-bit layout. 

3 MONITOR MONITOR/MWAIT. A value of 1 indicates the processor supports this feature. 

4 DS-CPL CPL Qualified Debug Store. A value of 1 indicates the processor supports the extensions to the 
Debug Store feature to allow for branch message storage qualified by CPL. 

5 VMX Virtual Machine Extensions. A value of 1 indicates that the processor supports this technology. 

6 SMX Safer Mode Extensions. A value of 1 indicates that the processor supports this technology. See 
Chapter 7, “Safer Mode Extensions Reference.” 

7 EIST Enhanced Intel SpeedStep® technology. A value of 1 indicates that the processor supports this 
technology. 

8 T2 Thermal Monitor 2. A value of 1 indicates whether the processor supports this technology. 

9 SSSE3 A value of 1 indicates the presence of the Supplemental Streaming SIMD Extensions 3 (SSSE3). A 
value of O indicates the instruction extensions are not present in the processor. 
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Table 3-10. Feature Information Returned in the ECX Register (Contd.) 


Bit # Mnemonic Description 

10 CNXT-ID L1 Context ID. A value of 1 indicates the L1 data cache mode can be set to either adaptive mode 
or shared mode. A value of 0 indicates this feature is not supported. See definition of the 
IA32_MISC_ENABLE MSR Bit 24 (L1 Data Cache Context Mode) for details. 

11 SDBG A value of 1 indicates the processor supports [A32_DEBUG_INTERFACE MSR for silicon debug. 

12 FMA A value of 1 indicates the processor supports FMA extensions using YMM state. 

13 CMPXCHG16B CMPXCHG16B Available. A value of 1 indicates that the feature is available. See the 
“CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes” section in this chapter for a 
description. 

14 xTPR Update XTPR Update Control. A value of 1 indicates that the processor supports changing 

Control IA32_MISC_ENABLE[bit 23]. 

15 PDCM Perfmon and Debug Capability: A value of 1 indicates the processor supports the performance 
and debug feature indication MSR IA32_PERF_CAPABILITIES. 

16 Reserved Reserved 

17 PCID Process-context identifiers. A value of 1 indicates that the processor supports PCIDs and that 
software may set CR4.PCIDE to 1. 

18 DCA A value of 1 indicates the processor supports the ability to prefetch data from a memory mapped 
device. 

19 SSE4_1 A value of 1 indicates that the processor supports SSE4.1. 

20 SSE4_2 A value of 1 indicates that the processor supports SSE4.2. 

21 X2APIC A value of 1 indicates that the processor supports x2APIC feature. 

22 MOVBE A value of 1 indicates that the processor supports MOVBE instruction. 

23 POPCNT A value of 1 indicates that the processor supports the POPCNT instruction. 

24 TSC-Deadline A value of 1 indicates that the processor's local APIC timer supports one-shot operation using a 
TSC deadline value. 

25 AESNI A value of 1 indicates that the processor supports the AESNI instruction extensions. 

26 XSAVE A value of 1 indicates that the processor supports the XSAVE/XRSTOR processor extended states 
feature, the XSETBV/XGETBV instructions, and XCRO. 

27 OSXSAVE A value of 1 indicates that the OS has set CR4.0SXSAVE[bit 18] to enable XSETBV/XGETBV 
instructions to access XCRO and to support processor extended state management using 
XSAVE/XRSTOR. 

28 AVX A value of 1 indicates the processor supports the AVX instruction extensions. 

29 F16C A value of 1 indicates that processor supports 16-bit floating-point conversion instructions. 

30 RDRAND A value of 1 indicates that processor supports RDRAND instruction. 

31 Not Used Always returns 0. 
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31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 87654321 0 


EDX 


PBE-Pend. Brk. sal 
TM-—Therm. Monitor 
HTT—Multi-threading ——— 
SS-—Self Snoop 

SSE2-SSE2 Extensions 
SSE-SSE Extensions 
FXSR-FXSAVE/FXRSTOR 
MMX-MMX Technology —_—— 
ACPI-Thermal Monitor and Clock Ctrl 
DS—Debug Store 
CLFSH-CLFLUSH instruction 
PSN-Processor Serial Number 
PSE-36 — Page Size Extension 
PAT-Page Attribute Table 
CMOV-Conditional Move/Compare Instruction 
MCA-Machine Check Architecture 
PGE-PTE Global Bit 
MTRR-—Memory Type Range Registers 
SEP-SYSENTER and SYSEXIT 
APIC-APIC on Chip 
CX8—CMPXCHG8B Inst. 
MCE-Machine Check Exception 
PAE-Physical Address Extensions 
MSR-RDMSR and WRMSR Support 
TSC-Time Stamp Counter 
PSE-Page Size Extensions 
DE-—Debugging Extensions 
VME-Virtual-8086 Mode Enhancement 
FPU-x87 FPU on Chip 


Reserved 


OM16523 


Figure 3-8. Feature Information Returned in the EDX Register 
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Table 3-11. More on Feature Information Returned in the EDX Register 


Bit # | Mnemonic | Description 

0 FPU Floating-Point Unit On-Chip. The processor contains an x87 FPU. 

1 VME Virtual 8086 Mode Enhancements. Virtual 8086 mode enhancements, including CR4.VME for controlling the 
feature, CR4.PVI for protected mode virtual interrupts, software interrupt indirection, expansion of the TSS 
with the software indirection bitmap, and EFLAGS.VIF and EFLAGS.VIP flags. 

2 DE Debugging Extensions. Support for I/O breakpoints, including CR4.DE for controlling the feature, and optional 
trapping of accesses to DR4 and DRS. 

3 PSE Page Size Extension. Large pages of size 4 MByte are supported, including CR4.PSE for controlling the 
feature, the defined dirty bit in PDE (Page Directory Entries), optional reserved bit trapping in CR3, PDEs, and 
PTEs. 

4 TSC Time Stamp Counter. The RDTSC instruction is supported, including CR4.TSD for controlling privilege. 

5 MSR Model Specific Registers RDMSR and WRMSR Instructions. The RDMSR and WRMSR instructions are 
supported. Some of the MSRs are implementation dependent. 

6 PAE Physical Address Extension. Physical addresses greater than 32 bits are supported: extended page table 
entry formats, an extra level in the page translation tables is defined, 2-MByte pages are supported instead of 
4 Mbyte pages if PAE bit is 1. 

7 MCE Machine Check Exception. Exception 18 is defined for Machine Checks, including CR4.MCE for controlling the 
feature. This feature does not define the model-specific implementations of machine-check error logging, 
reporting, and processor shutdowns. Machine Check exception handlers may have to depend on processor 
version to do model specific processing of the exception, or test for the presence of the Machine Check feature. 

8 CX8 CMPXCHG8B Instruction. The compare-and-exchange 8 bytes (64 bits) instruction is supported (implicitly 
locked and atomic). 

9 APIC APIC On-Chip. The processor contains an Advanced Programmable Interrupt Controller (APIC), responding to 
memory mapped commands in the physical address range FFFEQOOOH to FFFEOFFFH (by default - some 
processors permit the APIC to be relocated). 

10 |Reserved | Reserved 

11 SEP SYSENTER and SYSEXIT Instructions. The SYSENTER and SYSEXIT and associated MSRs are supported. 

12 |MTRR Memory Type Range Registers. MTRRs are supported. The MTRRcap MSR contains feature bits that describe 
what memory types are supported, how many variable MTRRs are supported, and whether fixed MTRRs are 
supported. 

13. | PGE Page Global Bit. The global bit is supported in paging-structure entries that map a page, indicating TLB entries 
that are common to different processes and need not be flushed. The CR4.PGE bit controls this feature. 

14 |MCA Machine Check Architecture. A value of 1 indicates the Machine Check Architecture of reporting machine 
errors is supported. The MCG_CAP MSR contains feature bits describing how many banks of error reporting 
MSRs are supported. 

15 | CMOV Conditional Move Instructions. The conditional move instruction CMOV is supported. In addition, if x87 FPU is 
present as indicated by the CPUID.FPU feature bit, then the FCOMI and FCMOV instructions are supported 

16 | PAT Page Attribute Table. Page Attribute Table is supported. This feature augments the Memory Type Range 
Registers (MTRRs), allowing an operating system to specify attributes of memory accessed through a linear 
address on a 4KB granularity. 

17 | PSE-36 36-Bit Page Size Extension. 4-MByte pages addressing physical memory beyond 4 GBytes are supported with 
32-bit paging. This feature indicates that upper bits of the physical address of a 4-MByte page are encoded in 
bits 20:13 of the page-directory entry. Such physical addresses are limited by MAXPHYADDR and may be up to 
40 bits in size. 

18 | PSN Processor Serial Number. The processor supports the 96-bit processor identification number feature and the 
feature is enabled. 

19 | CLFSH CLFLUSH Instruction. CLFLUSH Instruction is supported. 

20 | Reserved | Reserved 


3-246 Vol. 2A 


CPUID—CPU Identification 


INSTRUCTION SET REFERENCE, A-L 


Table 3-11. More on Feature Information Returned in the EDX Register (Contd.) 


Bit # | Mnemonic | Description 

21 DS Debug Store. The processor supports the ability to write debug information into a memory resident buffer. 
This feature is used by the branch trace store (BTS) and processor event-based sampling (PEBS) facilities (see 
Chapter 24, “Introduction to Virtual Machine Extensions,” in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 3C). 

22 =| ACPI Thermal Monitor and Software Controlled Clock Facilities. The processor implements internal MSRs that 
allow processor temperature to be monitored and processor performance to be modulated in predefined duty 
cycles under software control. 

23 | MMX Intel MMX Technology. The processor supports the Intel MMX technology. 

24 | FXSR FXSAVE and FXRSTOR Instructions. The FXSAVE and FXRSTOR instructions are supported for fast save and 
restore of the floating-point context. Presence of this bit also indicates that CR4.OSFXSR is available for an 
operating system to indicate that it supports the FXSAVE and FXRSTOR instructions. 

25 ~+| SSE SSE. The processor supports the SSE extensions. 

26 =| SSE2 SSE2. The processor supports the SSE2 extensions. 

27 ~|SS Self Snoop. The processor supports the management of conflicting memory types by performing a snoop of its 
own cache structure for transactions issued to the bus. 

28 «| HTT Max APIC IDs reserved field is Valid. A value of O for HTT indicates there is only a single logical processor in 
the package and software should assume only a single APIC ID is reserved. A value of 1 for HTT indicates the 
value in CPUID.1.EBX[23:16] (the Maximum number of addressable IDs for logical processors in this package) is 
valid for the package. 

29 =| TM Thermal Monitor. The processor implements the thermal monitor automatic thermal control circuitry (TCC). 

30 | Reserved | Reserved 

31 PBE Pending Break Enable. The processor supports the use of the FERR#/PBE# pin when the processor is in the 
stop-clock state (STPCLK# is asserted) to signal the processor that an interrupt is pending and that the 
processor should return to normal operation to handle the interrupt. 


INPUT EAX = 02H: TLB/Cache/Prefetch Information Returned in EAX, EBX, ECX, EDX 


When CPUID executes with EAX set to 02H, the processor returns information about the processor’s internal TLBs, 
cache, and prefetch hardware in the EAX, EBX, ECX, and EDX registers. The information is reported in encoded 
form and fall into the following categories: 


¢ The least-significant byte in register EAX (register AL) will always return 01H. Software should ignore this value 
and not interpret it as an informational descriptor. 


¢ The most significant bit (bit 31) of each register indicates whether the register contains valid information (set 
to 0) or is reserved (set to 1). 


¢ If a register contains valid information, the information is contained in 1 byte descriptors. There are four types 
of encoding values for the byte descriptor, the encoding type is noted in the second column of Table 3-12. Table 
3-12 lists the encoding of these descriptors. Note that the order of descriptors in the EAX, EBX, ECX, and EDX 
registers is not defined; that is, specific bytes are not designated to contain descriptors for specific cache, 
prefetch, or TLB types. The descriptors may appear in any order. Note also a processor may report a general 
descriptor type (FFH) and not report any byte descriptor of “cache type” via CPUID leaf 2. 
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Table 3-12. Encoding of CPUID Leaf 2 Descriptors 


irish Type Cache or TLB Description 
OOH General | Null descriptor, this byte contains no information. 
01H TLB Instruction TLB: 4 KByte pages, 4-way set associative, 32 entries. 
02H TLB Instruction TLB: 4 MByte pages, fully associative, 2 entries. 
03H TLB Data TLB: 4 KByte pages, 4-way set associative, 64 entries. 
04H TLB Data TLB: 4 MByte pages, 4-way set associative, 8 entries. 
05H TLB Data TLB1: 4 MByte pages, 4-way set associative, 32 entries. 
O6H Cache | 1st-level instruction cache: 8 KBytes, 4-way set associative, 32 byte line size. 
08H Cache | 1st-level instruction cache: 16 KBytes, 4-way set associative, 32 byte line size. 
09H Cache | 1st-level instruction cache: 32KBytes, 4-way set associative, 64 byte line size. 
OAH Cache | 1st-level data cache: 8 KBytes, 2-way set associative, 32 byte line size. 
OBH TLB Instruction TLB: 4 MByte pages, 4-way set associative, 4 entries. 
OCH Cache | 1st-level data cache: 16 KBytes, 4-way set associative, 32 byte line size. 
ODH Cache | 1st-level data cache: 16 KBytes, 4-way set associative, 64 byte line size. 
OEH Cache | 1st-level data cache: 24 KBytes, 6-way set associative, 64 byte line size. 
1DH Cache | 2nd-level cache: 128 KBytes, 2-way set associative, 64 byte line size. 
21H Cache | 2nd-level cache: 256 KBytes, 8-way set associative, 64 byte line size. 
22H Cache | 3rd-level cache: 512 KBytes, 4-way set associative, 64 byte line size, 2 lines per sector. 
23H Cache | 3rd-level cache: 1 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector. 
24H Cache | 2nd-level cache: 1 MBytes, 16-way set associative, 64 byte line size. 
25H Cache | 3rd-level cache: 2 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector. 
29H Cache | 3rd-level cache: 4 MBytes, 8-way set associative, 64 byte line size, 2 lines per sector. 
2CH Cache | 1st-level data cache: 32 KBytes, 8-way set associative, 64 byte line size. 
30H Cache | 1st-level instruction cache: 32 KBytes, 8-way set associative, 64 byte line size. 
40H Cache | No 2nd-level cache or, if processor contains a valid 2nd-level cache, no 3rd-level cache. 
41H Cache | 2nd-level cache: 128 KBytes, 4-way set associative, 32 byte line size. 
42H Cache | 2nd-level cache: 256 KBytes, 4-way set associative, 32 byte line size. 
43H Cache | 2nd-level cache: 512 KBytes, 4-way set associative, 32 byte line size. 
44H Cache | 2nd-level cache: 1 MByte, 4-way set associative, 32 byte line size. 
45H Cache | 2nd-level cache: 2 MByte, 4-way set associative, 32 byte line size. 
46H Cache | 3rd-level cache: 4 MByte, 4-way set associative, 64 byte line size. 
47H Cache | 3rd-level cache: 8 MByte, 8-way set associative, 64 byte line size. 
48H Cache | 2nd-level cache: 3MByte, 12-way set associative, 64 byte line size. 
49H Cache | 3rd-level cache: 4MB, 16-way set associative, 64-byte line size (Intel Xeon processor MP, Family OFH, 
Model 06H); 
2nd-level cache: 4 MByte, 16-way set associative, 64 byte line size. 
4AH Cache | 3rd-level cache: GMByte, 12-way set associative, 64 byte line size. 
4BH Cache | 3rd-level cache: 8MByte, 16-way set associative, 64 byte line size. 
4CH Cache | 3rd-level cache: 12MByte, 12-way set associative, 64 byte line size. 
4DH Cache | 3rd-level cache: 16MByte, 16-way set associative, 64 byte line size. 
4€H Cache | 2nd-level cache: GMByte, 24-way set associative, 64 byte line size. 
4FH TLB Instruction TLB: 4 KByte pages, 32 entries. 


3-248 Vol. 2A CPUID—CPU Identification 


INSTRUCTION SET REFERENCE, A-L 


Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.) 


pine Type Cache or TLB Description 
50H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 64 entries. 
51H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 128 entries. 
52H TLB Instruction TLB: 4 KByte and 2-MByte or 4-MByte pages, 256 entries. 
55H TLB Instruction TLB: 2-MByte or 4-MByte pages, fully associative, 7 entries. 
56H TLB Data TLBO: 4 MByte pages, 4-way set associative, 16 entries. 
57H TLB Data TLBO: 4 KByte pages, 4-way associative, 16 entries. 
59H TLB Data TLBO: 4 KByte pages, fully associative, 16 entries. 
5AH TLB Data TLBO: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries. 
5BH TLB Data TLB: 4 KByte and 4 MByte pages, 64 entries. 
5CH TLB Data TLB: 4 KByte and 4 MByte pages, 128 entries. 
5DH TLB Data TLB: 4 KByte and 4 MByte pages,256 entries. 
60H Cache | 1st-level data cache: 16 KByte, 8-way set associative, 64 byte line size. 
61H TLB Instruction TLB: 4 KByte pages, fully associative, 48 entries. 
63H TLB Data TLB: 2 MByte or 4 MByte pages, 4-way set associative, 32 entries and a Separate array with 1 GByte 
pages, 4-way set associative, 4 entries. 
64H TLB Data TLB: 4 KByte pages, 4-way set associative, 512 entries. 
66H Cache | 1st-level data cache: 8 KByte, 4-way set associative, 64 byte line size. 
67H Cache | 1st-level data cache: 16 KByte, 4-way set associative, 64 byte line size. 
68H Cache | 1st-level data cache: 32 KByte, 4-way set associative, 64 byte line size. 
6AH Cache |uTLB: 4 KByte pages, 8-way set associative, 64 entries. 
6BH Cache |DTLB: 4 KByte pages, 8-way set associative, 256 entries. 
6CH Cache |DTLB: 2M/4M pages, 8-way set associative, 128 entries. 
6DH Cache |DTLB: 1 GByte pages, fully associative, 16 entries. 
70H Cache | Trace cache: 12 K-wop, 8-way set associative. 
71H Cache | Trace cache: 16 K-wop, 8-way set associative. 
72H Cache | Trace cache: 32 K-uop, 8-way set associative. 
76H TLB Instruction TLB: 2M/4M pages, fully associative, 8 entries. 
78H Cache | 2nd-level cache: 1 MByte, 4-way set associative, 64byte line size. 
79H Cache | 2nd-level cache: 128 KByte, 8-way set associative, 64 byte line size, 2 lines per sector. 
7AH Cache | 2nd-level cache: 256 KByte, 8-way set associative, 64 byte line size, 2 lines per sector. 
7BH Cache | 2nd-level cache: 512 KByte, 8-way set associative, 64 byte line size, 2 lines per sector. 
7CH Cache | 2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size, 2 lines per sector. 
7DH Cache | 2nd-level cache: 2 MByte, 8-way set associative, 64byte line size. 
7FH Cache | 2nd-level cache: 512 KByte, 2-way set associative, 64-byte line size. 
80H Cache | 2nd-level cache: 512 KByte, 8-way set associative, 64-byte line size. 
82H Cache | 2nd-level cache: 256 KByte, 8-way set associative, 32 byte line size. 
83H Cache | 2nd-level cache: 512 KByte, 8-way set associative, 32 byte line size. 
84H Cache | 2nd-level cache: 1 MByte, 8-way set associative, 32 byte line size. 
85H Cache | 2nd-level cache: 2 MByte, 8-way set associative, 32 byte line size. 
86H Cache | 2nd-level cache: 512 KByte, 4-way set associative, 64 byte line size. 
87H Cache | 2nd-level cache: 1 MByte, 8-way set associative, 64 byte line size. 
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Table 3-12. Encoding of CPUID Leaf 2 Descriptors (Contd.) 


eairhite Type Cache or TLB Description 
AQH DTLB DTLB: 4k pages, fully associative, 32 entries. 
BOH TLB Instruction TLB: 4 KByte pages, 4-way set associative, 128 entries. 
B1H TLB Instruction TLB: 2M pages, 4-way, 8 entries or 4M pages, 4-way, 4 entries. 
B2H TLB Instruction TLB: 4KByte pages, 4-way set associative, 64 entries. 
B3H TLB Data TLB: 4 KByte pages, 4-way set associative, 128 entries. 
B4H TLB Data TLB1: 4 KByte pages, 4-way associative, 256 entries. 
B5H TLB Instruction TLB: 4KByte pages, 8-way set associative, 64 entries. 
B6H TLB Instruction TLB: 4KByte pages, 8-way set associative, 128 entries. 
BAH TLB Data TLB1: 4 KByte pages, 4-way associative, 64 entries. 
COH TLB Data TLB: 4 KByte and 4 MByte pages, 4-way associative, 8 entries. 
C1H STLB Shared 2nd-Level TLB: 4 KByte/2MByte pages, 8-way associative, 1024 entries. 

[ C2H | ODTLB  |DTLB:4KByte/2 MBytepages,4-wayassociative, Gentries. = = = | 
C3H STLB Shared 2nd-Level TLB: 4 KByte /2 MByte pages, 6-way associative, 1536 entries. Also 1GBbyte pages, 4- 
way, 16 entries. 
C4H DTLB DTLB: 2M/4M Byte pages, 4-way associative, 32 entries. 
CAH STLB Shared 2nd-Level TLB: 4 KByte pages, 4-way associative, 512 entries. 
DOH Cache | 3rd-level cache: 512 KByte, 4-way set associative, 64 byte line size. 
D1H Cache | 3rd-level cache: 1 MByte, 4-way set associative, 64 byte line size. 
D2H Cache | 3rd-level cache: 2 MByte, 4-way set associative, 64 byte line size. 
D6H Cache | 3rd-level cache: 1 MByte, 8-way set associative, 64 byte line size. 
D7H Cache | 3rd-level cache: 2 MByte, 8-way set associative, 64 byte line size. 
D8H Cache _| 3rd-level cache: 4 MByte, 8-way set associative, 64 byte line size. 
DCH Cache | 3rd-level cache: 1.5 MByte, 12-way set associative, 64 byte line size. 
DDH Cache | 3rd-level cache: 3 MByte, 12-way set associative, 64 byte line size. 
DEH Cache | 3rd-level cache: 6 MByte, 12-way set associative, 64 byte line size. 
E2H Cache | 3rd-level cache: 2 MByte, 16-way set associative, 64 byte line size. 
€3H Cache | 3rd-level cache: 4 MByte, 16-way set associative, 64 byte line size. 
E4H Cache | 3rd-level cache: 8 MByte, 16-way set associative, 64 byte line size. 
EAH Cache | 3rd-level cache: 12MByte, 24-way set associative, 64 byte line size. 
EBH Cache | 3rd-level cache: 18MByte, 24-way set associative, 64 byte line size. 
ECH Cache | 3rd-level cache: 24MByte, 24-way set associative, 64 byte line size. 
FOH Prefetch | 64-Byte prefetching. 
F1H Prefetch | 128-Byte prefetching. 
FEH General | CPUID leaf 2 does not report TLB descriptor information; use CPUID leaf 18H to query TLB and other 
address translation parameters. 
FFH General | CPUID leaf 2 does not report cache descriptor information, use CPUID leaf 4 to query cache parameters. 
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Example 3-1. Example of Cache and TLB Interpretation 


The first member of the family of Pentium 4 processors returns the following information about caches and TLBs 
when the CPUID executes with an input value of 2: 


EAX 66 5B 50 01H 
EBX OH 
ECX OH 
EDX 00 7A 70 OOH 


Which means: 
¢ The least-significant byte (byte 0) of register EAX is set to 01H. This value should be ignored. 


° The most-significant bit of all four registers (EAX, EBX, ECX, and EDX) is set to 0, indicating that each register 
contains valid 1-byte descriptors. 


° Bytes 1, 2, and 3 of register EAX indicate that the processor has: 
— 50H - a 64-entry instruction TLB, for mapping 4-KByte and 2-MByte or 4-MByte pages. 
— 5BH - a 64-entry data TLB, for mapping 4-KByte and 4-MByte pages. 
— 66H - an 8-KByte ist level data cache, 4-way set associative, with a 64-Byte cache line size. 
¢ The descriptors in registers EBX and ECX are valid, but contain NULL descriptors. 
° Bytes 0, 1, 2, and 3 of register EDX indicate that the processor has: 
— OOH - NULL descriptor. 
— 70H - Trace cache: 12 K-uop, 8-way set associative. 
— 7AH - a 256-KByte 2nd level cache, 8-way set associative, with a sectored, 64-byte cache line size. 
— OOH - NULL descriptor. 


INPUT EAX = 04H: Returns Deterministic Cache Parameters for Each Level 


When CPUID executes with EAX set to 04H and ECX contains an index value, the processor returns encoded data 
that describe a set of deterministic cache parameters (for the cache level associated with the input in ECX). Valid 
index values start from 0. 


Software can enumerate the deterministic cache parameters for each level of the cache hierarchy starting with an 
index value of 0, until the parameters report the value associated with the cache type field is 0. The architecturally 
defined fields reported by deterministic cache parameters are documented in Table 3-8. 


This Cache Size in Bytes 
= (Ways + 1) * (Partitions + 1) * (Line_Size + 1) * (Sets + 1) 
= (EBX[31:22] + 1) * (EBX[21:12] + 1) * (EBX[11:0] + 1) * (ECX + 1) 


The CPUID leaf 04H also reports data that can be used to derive the topology of processor cores in a physical 
package. This information is constant for all valid index values. Software can query the raw data reported by 
executing CPUID with EAX=04H and ECX=0 and use it as part of the topology enumeration algorithm described in 
Chapter 9, “Multiple-Processor Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3A. 


INPUT EAX = 05H: Returns MONITOR and MWAIT Features 


When CPUID executes with EAX set to 05H, the processor returns information about features available to 
MONITOR/MWAIT instructions. The MONITOR instruction is used for address-range monitoring in conjunction with 
MWAIT instruction. The MWAIT instruction optionally provides additional extensions for advanced power manage- 
ment. See Table 3-8. 


INPUT EAX = OGH: Returns Thermal and Power Management Features 


When CPUID executes with EAX set to 06H, the processor returns information about thermal and power manage- 
ment features. See Table 3-8. 
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INPUT EAX = 07H: Returns Structured Extended Feature Enumeration Information 


When CPUID executes with EAX set to 07H and ECX = 0, the processor returns information about the maximum 
input value for sub-leaves that contain extended feature flags. See Table 3-8. 


When CPUID executes with EAX set to 07H and the input value of ECX is invalid (see leaf 07H entry in Table 3-8), 
the processor returns 0 in EAX/EBX/ECX/EDxX. In subleaf 0, EAX returns the maximum input value of the highest 
leaf 7 sub-leaf, and EBX, ECX & EDX contain information of extended feature flags. 


INPUT EAX = OSH: Returns Direct Cache Access Information 


When CPUID executes with EAX set to 09H, the processor returns information about Direct Cache Access capabili- 
ties. See Table 3-8. 


INPUT EAX = OAH: Returns Architectural Performance Monitoring Features 


When CPUID executes with EAX set to OAH, the processor returns information about support for architectural 
performance monitoring capabilities. Architectural performance monitoring is supported if the version ID (see Table 
3-8) is greater than Pn O. See Table 3-8. 


For each version of architectural performance monitoring capability, software must enumerate this leaf to discover 
the programming facilities and the architectural performance events available in the processor. The details are 
described in Chapter 24, “Introduction to Virtual Machine Extensions,” in the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 3C. 


INPUT EAX = OBH: Returns Extended Topology Information 


CPUID leaf 1FH is a preferred superset to leaf OBH. Intel recommends first checking for the existence of Leaf 1FH 
before using leaf OBH. 


When CPUID executes with EAX set to OBH, the processor returns information about extended topology enumera- 
tion data. Software must detect the presence of CPUID leaf OBH by verifying (a) the highest leaf index supported 
by CPUID is >= OBH, and (b) CPUID.OBH:EBX[15:0] reports a non-zero value. See Table 3-8. 


INPUT EAX = ODH: Returns Processor Extended States Enumeration Information 


When CPUID executes with EAX set to ODH and ECX = 0, the processor returns information about the bit-vector 
representation of all processor state extensions that are supported in the processor and storage size requirements 
of the XSAVE/XRSTOR area. See Table 3-8. 


When CPUID executes with EAX set to ODH and ECX = n(n > 1, and is a valid sub-leaf index), the processor returns 
information about the size and offset of each processor extended state save area within the XSAVE/XRSTOR area. 
See Table 3-8. Software can use the forward-extendable technique depicted below to query the valid sub-leaves 
and obtain size and offset information for each processor extended state save area: 


For i = 2 to 62 // sub-leaf 1 is reserved 
IF (CPUID.(EAX=ODH, ECX=OH):VECTOR[I] = 1 ) // VECTOR is the 64-bit value of EDX:EAX 
Execute CPUID.(EAX=ODH, ECX = i) to examine size and offset for sub-leaf i; 
FI; 


INPUT EAX = OFH: Returns Intel Resource Director Technology (Intel RDT) Monitoring Enumeration Information 


When CPUID executes with EAX set to OFH and ECX = 0, the processor returns information about the bit-vector 
representation of QoS monitoring resource types that are supported in the processor and maximum range of RMID 
values the processor can use to monitor of any supported resource types. Each bit, starting from bit 1, corresponds 
to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or ResID) that soft- 
ware must use to query QoS monitoring capability available for that type. See Table 3-8. 


When CPUID executes with EAX set to OFH and ECX = n(n >= 1, and is a valid ResID), the processor returns infor- 
mation software can use to program IA32_PQR_ASSOC, IA32_QM_EVTSEL MSRs before reading QoS data from the 
IA32_QM_CTR MSR. 
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INPUT EAX = 10H: Returns Intel Resource Director Technology (Intel RDT) Allocation Enumeration Information 


When CPUID executes with EAX set to 10H and ECX = 0, the processor returns information about the bit-vector 
representation of QoS Enforcement resource types that are supported in the processor. Each bit, starting from bit 
1, corresponds to a specific resource type if the bit is set. The bit position corresponds to the sub-leaf index (or 
ResID) that software must use to query QoS enforcement capability available for that type. See Table 3-8. 


When CPUID executes with EAX set to 10H and ECX = n (n >= 1, and is a valid ResID), the processor returns infor- 
mation about available classes of service and range of QOS mask MSRs that software can use to configure each 
class of services using capability bit masks in the QoS Mask registers, IA32_resourceType_Mask_n. 


INPUT EAX = 12H: Returns Intel SGX Enumeration Information 


When CPUID executes with EAX set to 12H and ECX = OH, the processor returns information about Intel SGX capa- 
bilities. See Table 3-8. 


When CPUID executes with EAX set to 12H and ECX = 1H, the processor returns information about Intel SGX attri- 
butes. See Table 3-8. 


When CPUID executes with EAX set to 12H and ECX = n(n > 1), the processor returns information about Intel SGX 
Enclave Page Cache. See Table 3-8. 


INPUT EAX = 14H: Returns Intel Processor Trace Enumeration Information 


When CPUID executes with EAX set to 14H and ECX = OH, the processor returns information about Intel Processor 
Trace extensions. See Table 3-8. 


When CPUID executes with EAX set to 14H and ECX = n (n > O and less than the number of non-zero bits in 
CPUID.(EAX=14H, ECX= 0OH).EAX), the processor returns information about packet generation in Intel Processor 
Trace. See Table 3-8. 

INPUT EAX = 15H: Returns Time Stamp Counter and Nominal Core Crystal Clock Information 


When CPUID executes with EAX set to 15H and ECX = OH, the processor returns information about Time Stamp 
Counter and Core Crystal Clock. See Table 3-8. 


INPUT EAX = 16H: Returns Processor Frequency Information 


When CPUID executes with EAX set to 16H, the processor returns information about Processor Frequency Informa- 
tion. See Table 3-8. 


INPUT EAX = 17H: Returns System-On-Chip Information 


When CPUID executes with EAX set to 17H, the processor returns information about the System-On-Chip Vendor 
Attribute Enumeration. See Table 3-8. 


INPUT EAX = 18H: Returns Deterministic Address Translation Parameters Information 


When CPUID executes with EAX set to 18H, the processor returns information about the Deterministic Address 
Translation Parameters. See Table 3-8. 


INPUT EAX = 19H: Returns Key Locker Information 
When CPUID executes with EAX set to 19H, the processor returns information about Key Locker. See Table 3-8. 


INPUT EAX = 1AH: Returns Native Model ID Information 


When CPUID executes with EAX set to 1AH, the processor returns information about Native Model Identification. 
See Table 3-8. 


INPUT EAX = 1BH: Returns PCONFIG Information 


When CPUID executes with EAX set to 1BH, the processor returns information about PCONFIG capabilities. This 
information is enumerated in sub-leaves selected by the value of ECX (starting with 0). 
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Each sub-leaf of CPUID function 1BH enumerates its sub-leaf type in EAX. If a sub-leaf type is 0, the sub-leaf is 
invalid and zero is returned in EBX, ECX, and EDX. In this case, all subsequent sub-leaves (selected by larger input 
values of ECX) are also invalid. 


The only valid sub-leaf type currently defined is 1, indicating that the sub-leaf enumerates target identifiers for the 
PCONFIG instruction. Any non-zero value returned in EBX, ECX, or EDX indicates a valid target identifier of the 
PCONFIG instruction (any value of zero should be ignored). The only target identifier currently defined is 1, indi- 
cating TME-MK. See the “PCONFIG—Platform Configuration” instruction in Chapter 4 of the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 2B, for more information. 


INPUT EAX = 1CH: Returns Last Branch Record Information 


When CPUID executes with EAX set to 1CH, the processor returns information about LBRs (the architectural 
feature). See Table 3-8. 


INPUT EAX = 1DH: Returns Tile Information 


When CPUID executes with EAX set to 1DH and ECX = OH, the processor returns information about tile 
architecture. See Table 3-8. 


When CPUID executes with EAX set to 1DH and ECX = 1H, the processor returns information about tile palette 1. 
See Table 3-8. 


INPUT EAX = 1€H: Returns TMUL Information 


When CPUID executes with EAX set to 1EH and ECX = OH, the processor returns information about TMUL 
capabilities. See Table 3-8. 


INPUT EAX = 1FH: Returns V2 Extended Topology Information 


When CPUID executes with EAX set to 1FH, the processor returns information about extended topology enumera- 
tion data. Software must detect the presence of CPUID leaf 1FH by verifying (a) the highest leaf index supported 
by CPUID is >= 1FH, and (b) CPUID.1FH:EBX[15:0] reports a non-zero value. See Table 3-8. 


INPUT EAX = 20H: Returns History Reset Information 
When CPUID executes with EAX set to 20H, the processor returns information about History Reset. See Table 3-8. 


METHODS FOR RETURNING BRANDING INFORMATION 

Use the following techniques to access branding information: 

1. Processor brand string method. 

2. Processor brand index; this method uses a software supplied brand string table. 


These two methods are discussed in the following sections. For methods that are available in early processors, see 
Section: “Identification of Earlier IA-32 Processors” in Chapter 20 of the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volume 1. 


The Processor Brand String Method 


Figure 3-9 describes the algorithm used for detection of the brand string. Processor brand identification software 
should execute this algorithm on all Intel 64 and IA-32 processors. 


This method (introduced with Pentium 4 processors) returns an ASCII brand identification string and the Processor 
Base frequency of the processor to the EAX, EBX, ECX, and EDX registers. 
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Input: EAX= 
0x80000000 


IF (EAX & 0x80000000) 


IF (EAX Return Value 
2 0x80000004) 


False Processor Brand 


Function | Tue 
Supported Extended 


EAX Return Value = 
Max. Extended CPUID 
Function Index 


String Not 
Supported 


True Processor Brand 


String Supported 


OM 15194 


Figure 3-9. Determination of Support for the Processor Brand String 


How Brand Strings Work 


To use the brand string method, execute CPUID with EAX input of 8000002H through 80000004H. For each input 
value, CPUID returns 16 ASCII characters using EAX, EBX, ECX, and EDX. The returned string will be NULL-termi- 


nated. 


Table 3-13 shows the brand string that is returned by the first processor in the Pentium 4 processor family. 


Table 3-13. Processor Brand String Returned with Pentium 4 Processor 


EAX Input Value 


Return Values 


ASCII Equivalent 


80000002H 


80000003H 


EAX = 20202020H 
EBX = 20202020H 
ECX = 20202020H 
EDX = 6€492020H 
EAX = 286C6574H 
EBX = 50202952H 
ECX = 69746E65H 
EDX = 52286D75H 


“al 
“(let” 
"p )R" 
“itne" 
“R(mu" 
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Table 3-13. Processor Brand String Returned with Pentium 4 Processor (Contd.) 


EAX Input Value Return Values ASCII Equivalent 
80000004H EAX = 20342029H "“4y 
EBX = 20555043H “UPC” 
ECX = 30303531H "0051" 
EDX = 007A484DH “\OZHM" 


Extracting the Processor Frequency from Brand Strings 


Figure 3-10 provides an algorithm which software can use to extract the Processor Base frequency from the 
processor brand string. 


Scan "Brand String" in 
Reverse Byte Order 


"ZHM", or 
"ZHG", or 
"SHT" 


Match 
Substring 


IF Substring Matched 


False 
Report Error 


if "ZHM" 
True Multiplier = 1 x 10° 


Multiplier = 1 x 10° 
Determine "Multiplier" 


If "ZHT" ro ia 
Multiplier = 1 x 10 
Determine "Freq" 


Determine "Freq" 
and "Multiplier" 


Scan Digits 
Until Blank 


Reverse Digits 
To Decimal Value 


In Reverse Order 


Processor Base 
Frequency = 
"Freq" x "Multiplier" 


"Freq" = X.YZ if 
Digits = "ZY.X" 


Figure 3-10. Algorithm for Extracting Processor Frequency 


The Processor Brand Index Method 


The brand index method (introduced with Pentium® IIl Xeon® processors) provides an entry point into a brand 
identification table that is maintained in memory by system software and is accessible from system- and user-level 
code. In this table, each brand index is associate with an ASCII brand identification string that identifies the official 
Intel family and model number of a processor. 


When CPUID executes with EAX set to 1, the processor returns a brand index to the low byte in EBX. Software can 
then use this index to locate the brand identification string for the processor in the brand identification table. The 
first entry (brand index 0) in this table is reserved, allowing for backward compatibility with processors that do not 
support the brand identification feature. Starting with processor signature family ID = OFH, model = 03H, brand 
index method is no longer supported. Use brand string method instead. 


Table 3-14 shows brand indices that have identification strings associated with them. 
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Table 3-14. Mapping of Brand Indices; and Intel 64 and IA-32 Processor Brand Strings 


Brand Index Brand String 
OOH This processor does not support the brand identification feature 
01H Intel(R) Celeron(R) processor! 
02H Intel(R) Pentium(R) Ill processor! 
03H Intel(R) Pentium(R) Ill Xeon(R) processor; If processor signature = OOO006B1h, then Intel(R) Celeron(R) 
processor 
04H Intel(R) Pentium(R) Ill processor 
O6H Mobile Intel(R) Pentium(R) Ill processor-M 
07H Mobile Intel(R) Celeron(R) processor! 
08H Intel(R) Pentium(R) 4 processor 
OSH Intel(R) Pentium(R) 4 processor 
OAH Intel(R) Celeron(R) R) processor! 
OBH Intel(R) Xeon(R) processor; If processor signature = OQOOOOF1 3h, then Intel(R) Xeon(R) processor MP 
OCH Intel(R) Xeon(R) processor MP 
OEH Mobile Intel(R) Pentium(R) 4 processor-M; If processor signature = OOOOOF1 3h, then Intel(R) Xeon(R) processor 
OFH Mobile Intel(R) Celeron(R) processor! 
11H Mobile Genuine Intel(R) processor 
12H Intel(R) Celeron(R) M processor 
13H Mobile Intel(R) Celeron(R) processor! 
14H Intel(R) Celeron(R) processor 
15H Mobile Genuine Intel(R) processor 
16H Intel(R) Pentium(R) M processor 
17H Mobile Intel(R) Celeron(R) processor! 
18H - OFFH RESERVED 
NOTES: 


1. Indicates versions of these processors that were introduced after the Pentium Ill 


IA-32 Architecture Compatibility 


CPUID is not supported in early models of the Intel486 processor or in any IA-32 processor earlier than the 
Intel486 processor. 


Operation 
IA32_BlOS_SIGN_ID MSR := Update with installed microcode revision number; 


CASE (EAX) OF 

EAX = 0: 
EAX := Highest basic function input value understood by CPUID; 
EBX := Vendor identification string; 
EDX := Vendor identification string; 
ECX := Vendor identification string; 

BREAK; 

EAX = 1H: 
EAX[3:0] := Stepping ID; 
EAX[7:4] := Model; 
EAX[1 1:8] := Family; 
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EAX[13:12] := Processor type; 
EAX[15:14] := Reserved; 
EAX[19:16] := Extended Model; 
EAX[27:20] := Extended Family; 
EAX[31:28] := Reserved; 
EBX[7:0] := Brand Index; (* Reserved if the value is zero. *) 
EBX[15:8] := CLFLUSH Line Size; 
EBX[16:23] := Reserved; (* Number of threads enabled = 2 if MT enable fuse set. *) 
EBX[24:31] := Initial APIC ID; 
ECX := Feature flags; (* See Figure 3-7. *) 
EDX := Feature flags; (* See Figure 3-8. *) 
BREAK; 
EAX = 2H: 
EAX := Cache and TLB information; 
EBX := Cache and TLB information; 
ECX := Cache and TLB information; 
EDX := Cache and TLB information; 
BREAK; 
EAX = 3H: 
EAX := Reserved; 
EBX := Reserved; 
ECX := ProcessorSerialNumber[3 1:0]; 
(* Pentium Ill processors only, otherwise reserved. *) 
EDX := ProcessorSerialNumber[63:32]; 
(* Pentium Ill processors only, otherwise reserved. * 
BREAK 
EAX = 4H: 
EAX := Deterministic Cache Parameters Leaf; (* See Table 3-8. *) 
EBX := Deterministic Cache Parameters Leaf; 
ECX := Deterministic Cache Parameters Leaf; 
EDX := Deterministic Cache Parameters Leaf; 
BREAK; 
EAX = 5H: 
EAX := MONITOR/MWAIT Leaf; (* See Table 3-8. *) 
EBX := MONITOR/MWAIT Leaf; 
ECX := MONITOR/MWAIT Leaf; 
EDX := MONITOR/MWAIT Leaf; 
BREAK; 
EAX = 6H: 
EAX := Thermal and Power Management Leaf; (* See Table 3-8. *) 
EBX := Thermal and Power Management Leaf; 
ECX := Thermal and Power Management Leaf; 
EDX := Thermal and Power Management Leaf; 
BREAK; 
EAX = 7H: 
EAX := Structured Extended Feature Flags Enumeration Leaf; (* See Table 3-8. *) 
EBX := Structured Extended Feature Flags Enumeration Leaf; 
ECX := Structured Extended Feature Flags Enumeration Leaf; 
EDX := Structured Extended Feature Flags Enumeration Leaf; 
BREAK; 
EAX = 8H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
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EDX := Reserved = 0; 
BREAK; 
EAX = SH: 
EAX := Direct Cache Access Information Leaf; (* See Table 3-8. *) 
EBX := Direct Cache Access Information Leaf; 
ECX :!= Direct Cache Access Information Leaf; 
EDX := Direct Cache Access Information Leaf; 
BREAK; 
EAX = AH: 
EAX := Architectural Performance Monitoring Leaf; (* See Table 3-8. *) 
EBX := Architectural Performance Monitoring Leaf; 
ECX := Architectural Performance Monitoring Leaf; 
EDX := Architectural Performance Monitoring Leaf; 
BREAK 
EAX = BH: 
EAX := Extended Topology Enumeration Leaf; (* See Table 3-8. *) 
EBX := Extended Topology Enumeration Leaf; 
ECX := Extended Topology Enumeration Leaf; 
EDX := Extended Topology Enumeration Leaf; 
BREAK; 
EAX = CH: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = DH: 
EAX := Processor Extended State Enumeration Leaf; (* See Table 3-8. *) 
EBX := Processor Extended State Enumeration Leaf; 
ECX != Processor Extended State Enumeration Leaf; 
EDX := Processor Extended State Enumeration Leaf; 
BREAK; 
EAX = EH: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = FH: 
EAX := Intel Resource Director Technology Monitoring Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
ECX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
EDX := Intel Resource Director Technology Monitoring Enumeration Leaf; 
BREAK; 
EAX = 10H: 
EAX := Intel Resource Director Technology Allocation Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Resource Director Technology Allocation Enumeration Leaf; 
ECX := Intel Resource Director Technology Allocation Enumeration Leaf; 
EDX := Intel Resource Director Technology Allocation Enumeration Leaf; 
BREAK; 
EAX = 12H: 
EAX := Intel SGX Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel SGX Enumeration Leaf; 
ECX :!= Intel SGX Enumeration Leaf; 
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EDX := Intel SGX Enumeration Leaf; 
BREAK; 
EAX = 14H: 
EAX := Intel Processor Trace Enumeration Leaf; (* See Table 3-8. *) 
EBX := Intel Processor Trace Enumeration Leaf; 
ECX := Intel Processor Trace Enumeration Leaf; 
EDX := Intel Processor Trace Enumeration Leaf; 
BREAK; 
EAX = 15H: 
EAX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; (* See Table 3-8. *) 
EBX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
ECX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
EDX := Time Stamp Counter and Nominal Core Crystal Clock Information Leaf; 
BREAK; 
EAX = 16H: 
EAX := Processor Frequency Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := Processor Frequency Information Enumeration Leaf; 
ECX := Processor Frequency Information Enumeration Leaf; 
EDX := Processor Frequency Information Enumeration Leaf; 
BREAK; 
EAX = 17H: 
EAX := System-On-Chip Vendor Attribute Enumeration Leaf; (* See Table 3-8. *) 
EBX := System-On-Chip Vendor Attribute Enumeration Leaf; 
ECX := System-On-Chip Vendor Attribute Enumeration Leaf; 
EDX := System-On-Chip Vendor Attribute Enumeration Leaf; 
BREAK; 
EAX = 18H: 
EAX := Deterministic Address Translation Parameters Enumeration Leaf; (* See Table 3-8. *) 
EBX := Deterministic Address Translation Parameters Enumeration Leaf; 
ECX := Deterministic Address Translation Parameters Enumeration Leaf; 
EDX := Deterministic Address Translation Parameters Enumeration Leaf; 
BREAK; 
EAX = 19H: 
EAX := Key Locker Enumeration Leaf; (* See Table 3-8. *) 
EBX := Key Locker Enumeration Leaf; 
ECX := Key Locker Enumeration Leaf; 
EDX := Key Locker Enumeration Leaf; 
BREAK; 
EAX = 1AH: 
EAX := Native Model ID Enumeration Leaf; (* See Table 3-8. *) 
EBX := Native Model ID Enumeration Leaf; 
ECX := Native Model ID Enumeration Leaf; 
EDX := Native Model ID Enumeration Leaf; 
BREAK; 
EAX = 1BH: 
EAX := PCONFIG Information Enumeration Leaf; (* See “INPUT EAX = 1BH: Returns PCONFIG Information” on page 3-253. *) 
EBX := PCONFIG Information Enumeration Leaf; 
ECX := PCONFIG Information Enumeration Leaf; 
EDX := PCONFIG Information Enumeration Leaf; 
BREAK; 
EAX = 1CH: 
EAX := Last Branch Record Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := Last Branch Record Information Enumeration Leaf; 
ECX := Last Branch Record Information Enumeration Leaf; 
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EDX := Last Branch Record Information Enumeration Leaf; 
BREAK; 
EAX = 1DH: 
EAX := Tile Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := Tile Information Enumeration Leaf; 
ECX != Tile Information Enumeration Leaf; 
EDX := Tile Information Enumeration Leaf; 
BREAK; 
EAX = 1EH: 
EAX := TMUL Information Enumeration Leaf; (* See Table 3-8. *) 
EBX := TMUL Information Enumeration Leaf; 
ECX := TMUL Information Enumeration Leaf; 
EDX := TMUL Information Enumeration Leaf; 
BREAK; 
EAX = 1FH: 
EAX := V2 Extended Topology Enumeration Leaf; (* See Table 3-8. *) 
EBX := V2 Extended Topology Enumeration Leaf; 
ECX := V2 Extended Topology Enumeration Leaf; 
EDX := V2 Extended Topology Enumeration Leaf; 
BREAK; 
EAX = 20H: 
EAX := Processor History Reset Sub-leaf; (* See Table 3-8. *) 
EBX := Processor History Reset Sub-leaf; 
ECX := Processor History Reset Sub-leaf; 
EDX := Processor History Reset Sub-leaf; 
BREAK; 
EAX = 80000000H: 
EAX := Highest extended function input value understood by CPUID; 
EBX := Reserved; 
ECX := Reserved; 
EDX := Reserved; 
BREAK; 
EAX = 80000001H: 
EAX := Reserved; 
EBX := Reserved; 
ECX := Extended Feature Bits (* See Table 3-8.*); 
EDX := Extended Feature Bits (* See Table 3-8. *); 
BREAK; 
EAX = 80000002H: 
EAX := Processor Brand String; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000003H: 
EAX := Processor Brand String, continued; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000004H: 
EAX := Processor Brand String, continued; 
EBX := Processor Brand String, continued; 
ECX := Processor Brand String, continued; 
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EDX := Processor Brand String, continued; 
BREAK; 
EAX = 80000005H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX = 80000006H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Cache information; 
EDX := Reserved = 0; 
BREAK; 
EAX = 80000007H: 
EAX := Reserved = 0; 
EBX := Reserved = 0; 
ECX := Reserved = 0; 
EDX := Reserved = Misc Feature Flags; 
BREAK; 
EAX = 80000008H: 
EAX := Address Size Information; 
EBX := Misc Feature Flags; 
ECX := Reserved = 0; 
EDX := Reserved = 0; 
BREAK; 
EAX >= 40000000H and EAX <= 4FFFFFFFH: 
DEFAULT: (* EAX = Value outside of recognized range for CPUID. *) 
(* If the highest basic information leaf data depend on ECX input value, ECX is honored.*) 
EAX := Reserved; (* Information returned for highest basic information leaf. *) 
EBX := Reserved; (* Information returned for highest basic information leaf. *) 
ECX := Reserved; (* Information returned for highest basic information leaf. *) 
EDX := Reserved; (* Information returned for highest basic information leaf. *) 
BREAK; 
ESAC; 


Flags Affected 
None. 


Exceptions (All Operating Modes) 
#UD If the LOCK prefix is used. 


In earlier IA-32 processors that do not support the CPUID instruction, execution of the instruc- 
tion results in an invalid opcode (#UD) exception being generated. 
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INVD—Invalidate Internal Caches 


Opcode’™ Instruction Op/ | 64-Bit Compat/ |Description 
En |Mode Leg Mode 
OF 08 INVD ZO ‘| Valid Valid Flush internal caches; initiate flushing of 
external caches. 


NOTES: 
1. See the IA-32 Architecture Compatibility section below. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
ZO N/A N/A N/A N/A 
Description 


Invalidates (flushes) the processor’s internal caches and issues a special-function bus cycle that directs external 
caches to also flush themselves. Data held in internal caches is not written back to main memory. 


After executing this instruction, the processor does not wait for the external caches to complete their flushing oper- 
ation before proceeding with instruction execution. It is the responsibility of hardware to respond to the cache flush 
signal. 


The INVD instruction is a privileged instruction. When the processor is running in protected mode, the CPL of a 
program or procedure must be 0 to execute this instruction. 


The INVD instruction may be used when the cache is used as temporary memory and the cache contents need to 
be invalidated rather than written back to memory. When the cache is used as temporary memory, no external 
device should be actively writing data to main memory. 


Use this instruction with care. Data cached internally and not written back to main memory will be lost. Note that 
any data from an external device to main memory (for example, via a PCIWrite) can be temporarily stored in the 
caches; these data can be lost when an INVD instruction is executed. Unless there is a specific requirement or 
benefit to flushing caches without writing back modified cache lines (for example, temporary memory, testing, or 
fault recovery where cache coherency with main memory is not a concern), software should instead use the 
WBINVD instruction. 


On processors that support processor reserved memory, the INVD instruction cannot be executed when processor 
reserved memory protections are activated. See Section 36.5, “EPC and Management of EPC Pages,” in the Intel® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 3D. 


Some processors prevent execution of INVD after BIOS execution is complete. They report this by enumerating 
CPUID.(EAX=07H,ECX=1H):EAX[bit 30] as 1. On such processors, INVD cannot be executed if bit 0 of 
SR_BIOS_DONE (MSR address 151H) is 1. 


This instruction’s operation is the same in non-64-bit modes and 64-bit mode. 


IA-32 Architecture Compatibility 
The INVD instruction is implementation dependent; it may be implemented differently on different families of Intel 


64 or IA-32 processors. This instruction is not supported on IA-32 processors earlier than the Intel486 processor. 


Operation 


Flush(InternalCaches); 
SignalFlush(ExternalCaches); 
Continue (* Continue execution *) 


Flags Affected 
None. 
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Protected Mode Exceptions 
#GP(0) If the current privilege level is not 0. 
If the processor reserved memory protections are activated. 


If CPUID.(EAX=07H, ECX=1H):EAX[30] = 1 and bit 0 is set in MSR_BIOS_DONE (MSR 
address 151H). 


#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 


#GP(0) If CPUID.(EAX=07H, ECX=1H):EAX[30] = 1 and bit 0 is set in MSR_BIOS_DONE (MSR 
address 151H). 


If the processor reserved memory protections are activated. 
#UD If the LOCK prefix is used. 


Virtual-8086 Mode Exceptions 
#GP(0) The INVD instruction cannot be executed in virtual-8086 mode. 


Compatibility Mode Exceptions 
Same exceptions as in protected mode. 


64-Bit Mode Exceptions 
Same exceptions as in protected mode. 
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6. Updates to Chapter 4, Volume 2B 
Change bars and violet text show changes to Chapter 4 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2B: Instruction Set Reference, M-U. 


Changes to this chapter: 

e Updated the PREFETCHW instruction table to match the “Op/En” column value to the correct value in the 
Instruction Operand Encoding table. Previously, this table erroneously listed a value of ‘A’ instead of the 
correct value of ‘M.’ 
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PREFETCHW—Prefetch Data Into Caches in Anticipation of a Write 


Opcode/ Op/ |64/32 bit | CPUID Description 
Instruction En Mode Feature Flag 
Support 
OF OD /1 M VV PREFETCHW | Move data from m8 closer to the processor in anticipation of a 
PREFETCHW m8 write. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
M ModRM:r/m (r) N/A N/A N/A 
Description 


Fetches the cache line of data from memory that contains the byte specified with the source operand to a location 
in the 1st or 2nd level cache and invalidates other cached instances of the line. 


The source operand is a byte memory location. If the line selected is already present in the lowest level cache and 
is already in an exclusively owned state, no data movement occurs. Prefetches from non-writeback memory are 
ignored. 


The PREFETCHW instruction is merely a hint and does not affect program behavior. If executed, this instruction 
moves data closer to the processor and invalidates other cached copies in anticipation of the line being written to 
in the future. 


The characteristic of prefetch locality hints is implementation-dependent, and can be overloaded or ignored by a 
processor implementation. The amount of data prefetched is also processor implementation-dependent. It will, 
however, be a minimum of 32 bytes. Additional details of the implementation-dependent locality hints are 
described in Section 7.4 of Intel® 64 and IA-32 Architectures Optimization Reference Manual. 


It should be noted that processors are free to speculatively fetch and cache data with exclusive ownership from 
system memory regions that permit such accesses (that is, the WB memory type). A PREFETCHW instruction is 
considered a hint to this speculative behavior. Because this speculative fetching can occur at any time and is not 
tied to instruction execution, a PREFETCHW instruction is not ordered with respect to the fence instructions 
(MFENCE, SFENCE, and LFENCE) or locked memory references. A PREFETCHW instruction is also unordered with 
respect to CLFLUSH and CLFLUSHOPT instructions, other PREFETCHW instructions, or any other general instruction 


It is ordered with respect to serializing instructions such as CPUID, WRMSR, OUT, and MOV CR. 
This instruction's operation is the same in non-64-bit modes and 64-bit mode. 


Operation 
FETCH_WITH_EXCLUSIVE_OWNERSHIP (m8); 


Flags Affected 
None. 


C/C++ Compiler Intrinsic Equivalent 


void _m_prefetchw( void * ); 


Protected Mode Exceptions 
#UD If the LOCK prefix is used. 


Real-Address Mode Exceptions 
#UD If the LOCK prefix is used. 
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Virtual-8086 Mode Exceptions 
#UD If the LOCK prefix is used. 


Compatibility Mode Exceptions 
#UD If the LOCK prefix is used. 


64-Bit Mode Exceptions 
#UD If the LOCK prefix is used. 
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7. Updates to Chapter 5, Volume 2C 


Change bars and violet text show changes to Chapter 5 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2C: Instruction Set Reference, V. 


Changes to this chapter: 


Updated the VPBLENDD instruction to use “dword” instead of “word” since the instruction operates on dwords. 
Updated the VGETMANTSS instruction to change “Vector” to “Scalar” in the instruction title. 

Updated the VFCMADDCPH/VFMADDCPH instructions to correct the description box for both the normal and 
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change. 
Updated the VFCMADDCSH/VFMADDCSH instructions to correct the description box for both the normal and 
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change. 
Removed two duplicate intrinsics for the VFCMADDCSH instruction and added two missing intrinsics for the 
VFMADDCSH instruction. 

Updated the VFCMULCPH/VFMULCPH instructions to correct the description box for both the normal and 
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change. 
Updated the VFCMULCSH/VFMULCSH instructions to correct the description box for both the normal and 
complex conjugate forms. They erroneously reported the opposite descriptions and needed a wording change. 
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VFCMADDCPH/VFMADDCPH—Complex Multiply and Accumulate FP16 Values 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En BitMode | Flag 
Support 
EVEX.128.F2.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMADDCPH xmm1{k1}{z}, xmm2, AVX512VL xmme2 and complex conjugate of 
xmm3/m128/m32bcst xmm3/m128/m32bcst, add to xmm1 and store 
the result in xmm1 subject to writemask k1. 
EVEX.256.F2.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMADDCPH ymm1{k1}{z}, ymm2, AVX512VL ymm_2 and complex conjugate of 
ymm3/m256/m32bcst ymm3/m256/m32bcst, add to ymm1 and store 
the result in ymm1 subject to writemask k1. 
EVEX.512.F2.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMADDCPH zmm1{k1}{z}, zmm2, zmm_2 and complex conjugate of 
zmm3/m512/m32bcst {er} zmm3/m512/m32bcst, add to zmm1 and store 
the result in zmm1 subject to writemask k1. 
EVEX.128.F3.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMADDCPH xmm1{k1}{z}, xmme2, AVX512VL xmme2 and xmm3/m128/m32bcst, add to xmm1 
xmm3/m128/m32bcst and store the result in xmm1 subject to 
writemask k1. 
EVEX.256.F3.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMADDCPH ymm1{k1}{z}, ymm2, AVX512VL ymme2 and ymm3/m256/m32bcst, add to ymm1 
ymm3/m256/m32bcst and store the result in ymm1 subject to 
writemask k1. 
EVEX.512.F3.MAP6.WO 56 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMADDCPH zmm1{k1}{z}, zmm2, zmm2 and zmm3/m512/m32bcst, add to zmm1 
zmm3/m512/m32bcst {er} and store the result in zmm1 subject to 
writemask k1. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) N/A 
Description 


This instruction performs a complex multiply and accumulate operation. There are normal and complex conjugate 
forms of the operation. 


The broadcasting and masking for this operation is done on 32-bit quantities representing a pair of FP16 values. 


Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep- 
tions are masked. MXCSR status bits are updated to reflect exceptional conditions. 
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Operation 


VFCMADDCPH dest{k1}, src1, src2 (AVX512) 
VL = 128, 256, 512 
KL := VL/32 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 

IF broadcasting and src2 is memory: 
tsrc2.fp16[2*i+0] := src2.fp16[0] 
tsrc2.fp16[2*i+1] := src2.fp16[1] 

ELSE: 
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0] 
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
tmp[2*i+0] := dest.fp16[2*i+0] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+0] 
tmp[2*i+1] := dest.fp16[2*i+1] + src1.fp16[2*i+1] * tsrc2.fp16[2*i+0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
// conjugate version subtracts odd final term 
dest.fp16[2*i+0] := tmp[2*i+0] + src1.fp16[2*i+1] * tsrc2.fp16[2*i+1] 
dest.fp16[2*i+1] := tmp[2*i+1] - src1.fp16[2*i+0] * tsrc2.fp16[2*i+1] 
ELSE IF *zeroing*: 
dest.fp16[2*i+0] := 0 
dest.fp16[2*i+1] := 0 


DEST[MAXVL-1:VL] := 0 


VFMADDCPH dest{k1}, src, src2 (AVX512) 
VL = 128, 256, 512 
KL := VL/32 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 

IF broadcasting and src2 is memory: 
tsrc2.fp16[2*i+0] := src2.fp16[0] 
tsrc2.fp16[2*i+1] := src2.fp16[1] 

ELSE: 
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0] 
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
tmp[2*i+0] := dest.fp16[2*i+0] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+0] 
tmp[2*i+1] := dest.fp16[2*i+1] + src1.fp16[2*i+1] * tsrc2.fp1 6[2*i+0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
// non-conjugate version subtracts even term 
dest.fp16[2*i+0] := tmp[2*i+0] - src1.fp16[2*i+1] * tsrc2.fp16[2*i+1] 
dest.fp16[2*i+1] := tmp[2*i+1] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+ 1] 
ELSE IF *zeroing*: 
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dest.fp16[2*i+0] := 0 
dest.fp16[2*i+1] := 0 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFCMADDCPH __m128h __mm_fcmadd_pch (__m128h a,__m128hb,__m128hc); 

VFCMADDCPH __m128h __mm_mask_fcmadd_pch (__m128h a, ___mmask8 k,__m128h b,___m128h c); 

VFCMADDCPH __m128h __mm_mask3_fcmadd_pch (__m128h a,__m128hb,__m128hc,__mmask8 k); 

VFCMADDCPH __m128h __mm_maskz_fcmadd_pch (__mmask8 k,__m128ha,__m128hb, __m128h c); 

VFCMADDCPH __m256h_mm256_fcmadd_pch (__m256ha,__m256hb,__ m256h c); 

VFCMADDCPH __m256h __mm256_mask_fcmadd_pch (__m256ha,__mmask8k,__ m256hb,__ m256h c); 

VFCMADDCPH __m256h __mm256_mask3_fcmadd_pch (__m256h a,__m256h b,___m256h c,___mmask8 k); 

VFCMADDCPH __m256h __mm256_maskz_fcmadd_pch (__mmask8 k,__ m256ha,__m256h b, __m256h c); 

VFCMADDCPH __m512h_mm512_fcmadd_pch (_m512ha,__m512hb,__m512hc); 

VFCMADDCPH __m512h_mm512_mask_fcmadd_pch (__m512ha,__mmask16 k,__m512hb,__m512hc); 

VFCMADDCPH __m512h_mm512_mask3_fcmadd_pch (_m512ha,__m512hb,__m512hc,___mmask16 k); 

VFCMADDCPH __m512h_mm512_maskz_fcmadd_pch (__mmask16 k,__m512ha,__m512hb,_m512h c); 

VFCMADDCPH __m512h_mm512_fcmadd_round_pch (__m512ha,__m512hb,__m512h¢c, const int rounding); 

VFCMADDCPH __m512h_mm512_mask_fcmadd_round_pch (__m512h a,__mmask16 k,__m512hb,__m512h¢, const int rounding); 
VFCMADDCPH __m512h_mm512_mask3_fcmadd_round_pch (__m512ha,__m512hb,__m512hc, __mmask16 k, const int rounding); 
VFCMADDCPH __m512h __mm512_maskz_fcmadd_round_pch (__mmask16 k,__m512ha,__m512hb,__m512hc, const int rounding); 


VFMADDCPH __m128h __mm_fmadd_pch (_m128ha,__m128hb,__m128h c); 

VFMADDCPH __m128h __mm_mask_fmadd_pch (__m128h a,__mmask8 k,__m128hb,__m128h c); 

VFMADDCPH __m128h __mm_mask3_fmadd_pch (__m128ha,__m128hb,_m128hc,__mmask8 k); 

VFMADDCPH __m128h __mm_maskz_fmadd_pch (__mmask8 k,___m128ha,__m128hb,_m128h c); 

VFMADDCPH __m256h __mm256_fmadd_pch (__m256h a, __m256h b, __m256h c); 

VFMADDCPH __m256h __mm256_mask_fmadd_pch (__m256h a, ___mmask8 k,__ m256h b, __m256h c); 

VFMADDCPH __m256h __mm256_mask3_fmadd_pch (__m256h a,__m256hb,__ m256hc, __ mmask8 k); 

VFMADDCPH __m256h __mm256_maskz_fmadd_pch (__mmask8 k,__ m256ha,__m256hb, __m256h c); 

VFMADDCPH __m512h __mm512_fmadd_pch (_m512ha,__m512hb,__m512h c); 

VFMADDCPH __m512h _mm512_mask_fmadd_pch (_m512ha,__mmask16 k,__m512hb,_m512h c); 

VFMADDCPH __m512h_mm512_mask3_fmadd_pch (_m512ha,__m512hb,__m512hc,__mmask16 k); 

VFMADDCPH __m512h_mm512_maskz_fmadd_pch (__mmask16 k,__m512ha,__m512hb,__m512hc); 

VFMADDCPH __m512h_mm512_fmadd_round_pch (_m512ha,__m512hb,__m512hc, const int rounding); 

VFMADDCPH __m512h_mm512_mask_fmadd_round_pch (__m512ha,__mmask16 k,__m512hb,__m512hc, const int rounding); 
VFMADDCPH __m512h_mm512_mask3_fmadd_round_pch (_m512ha,__m512hb,__m512hc,__mmask16 k, const int rounding); 
VFMADDCPH __m512h __mm512_maskz_fmadd_round_pch (__mmask16 k,__m512ha,__m512hb,__m512hc, const int rounding); 


SIMD Floating-Point Exceptions 
Invalid, Underflow, Overflow, Precision, Denormal. 


Other Exceptions 

EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions.” 
Additionally: 

#UD If (dest_reg == srci_reg) or (dest_reg == src2_reg). 
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VFCMADDCSH/VFMADDCSH—Complex Multiply and Accumulate Scalar FP16 Values 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En BitMode | Flag 
Support 
EVEX.LLIG.F2.MAP6.WO 57 /r A VV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMADDCSH xmm1{k1}{z}, xmm2, xmm_2 and complex conjugate of xmm3/m32, add 
xmm3/m32 {er} to xmm1 and store the result in xmm1 subject to 
writemask k1. Bits 127:32 of xmm2 are copied 
to xmm1[127:32]. 
EVEX.LLIG.F3.MAP6.WO 57 /r A VV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMADDCSH xmm1{k1}{z}, xmm2z, xmme2 and xmm3/m32, add to xmm1 and store 
xmm3/m32 {er} the result in xmm1 subject to writemask k1. Bits 
127:32 of xmmz2 are copied to xmm1[127:32]. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Scalar ModRM:reg (r, w) VEX.vvvv (r) ModRM:r/m (r) N/A 
Description 


This instruction performs a complex multiply and accumulate operation. There are normal and complex conjugate 


forms of the operation. 
The masking for this operation is done on 32-bit quantities representing a pair of FP16 values. 


Bits 127:32 of the destination operand are copied from the corresponding bits of the first source operand. Bits 
MAXVL-1:128 of the destination operand are zeroed. The low FP16 element of the destination is updated according 
to the writemask. 


Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep- 
tions are masked. MXCSR status bits are updated to reflect exceptional conditions. 


Operation 


VFCMADDCSH dest{k1}, src1, src2 (AVX512) 


IF k1[0] or *no writemask*: 


tmp[0] := dest.fp16[0] + src1.fp16[0] * src2.fp16[0] 
tmp[1] := dest.fp16[1] + src1.fp16[1] * src2.fp16[0] 


// conjugate version subtracts odd final term 
dest.fp16[0] := tmp[O] + src1.fp16[1] * src2.fp16[1] 
dest.fp16[1] := tmp[1] - src1.fp16[0] * src2.fp16[1] 
ELSE IF *zeroing*: 
dest.fp16[0] := 0 
dest.fp16[1] := 0 


DEST[1 27:32] := src1[127:32] // copy upper part of src 


DEST[MAXVL-1:128] := 0 
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VFMADDCSH dest{k1}, src1, src2 (AVX512) 
IF k1[O0] or *no writemask*: 
tmp[0] := dest.fp16[0] + src1.fp16[0] * src2.fp16[0] 
tmp[1] := dest.fp16[1] + src1.fp16[1] * src2.fp16[0] 


// non-conjugate version subtracts last even term 
dest.fp16[0] := tmp[0] - src1.fp16[1] * src2.fp16[1] 
dest.fp16[1] := tmp[1] + src1.fp16[0] * src2.fp16[1] 
ELSE IF *zeroing*: 
dest.fp16[0] := 0 
dest.fp16[1] := 0 


DEST[1 27:32] := src1[127:32] // copy upper part of src1 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 
VFCMADDCSH 


VFMADDCSH 


m12sh 


mm. 


m128sh 


mm. 


fcmadd_round_sch ( 
mask_fcmadd_round_sch ( 


m128ha,__m128hb,_m128h ¢, const int rounding); 
m128h a,__mmask8 k,__m128hb,__m128h ¢, const int rounding); 


m128h 


mm. 


mask3_fcmadd_round_sch (_m128h a,__m128hb,__m128hc,__mmask8 k, const int rounding); 


m128h 


mm. 


maskz_fcmadd_round_sch (__mmask8 k,___m128ha,__m128hb,__m128h ¢, const int rounding); 


m128h 


mm. 


fcmadd_sch (__m128ha,__m128hb,__m128h c); 


m128sh 


mm. 


mask_fcmadd_sch (__m128h a, ___mmask8 k,__m128h b,___m128h c); 


m128h 


mm. 


mask3_fcmadd_sch (_m128h a,__m128hb,__m128hc,__mmask8 k); 


m128sh 


mm. 


m128h 


mm. 


maskz_fcmadd_sch (__mmask8 k,__m128ha,__m128hb, ___m128h c); 


fmadd_round_sch (_m128h a,__m128hb,__m128hc, const int rounding); 


VFMADDCSH 


m128h 


mm. 


mask_fmadd_round_sch (__m128ha,__mmask8 k,_m128hb,__m128h ¢, const int rounding); 


VFMADDCSH 


m128h 


mm. 


mask3_fmadd_round_sch (__m128ha,__m128hb,___m128hc,___mmask8 k, const int rounding); 


VFMADDCSH 


m128h 


mm. 


maskz_fmadd_round_sch (__mmask8 k,__m128ha,__m128hb,__m128h ¢, const int rounding); 


VFMADDCSH 


m128h 


mm. 


fmadd_sch (_m128ha,__m128hb,__m128h c); 


VFMADDCSH 


m128h 


mm 


VFMADDCSH 


m128h 


mm. 


mask_fmadd_sch (__m128h a,__mmask8 k,___m128hb,___m128hc); 
mask3_fmadd_sch (_m128ha,__m128hb,__m128hc,___mmask8 k); 


VFMADDCSH 


m128h 


mm. 


maskz_fmadd_sch (__mmask8 k,__m128ha,__m128hb,__m128hc); 


SIMD Floating-Point Exceptions 


Invalid, Underflow, Overflow, Precision, Denormal. 


Other Exceptions 


EVEX-encoded instructions, see Table 2-58, “Type E10 Class Exception Conditions.” 


Additionally: 


#UD 
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Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En | BitMode | Flag 
Support 
EVEX.128.F2.MAP6.WO D6 /r A VV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMULCPH xmm1{k1}{z}, xmm2, AVX512VL xmm_2 and complex conjugate of 
xmm3/m128/m32bcst xmm3/m128/m32bcst, and store the result in 
xmm1 subject to writemask k1. 
EVEX.256.F2.MAP6.WO D6 /r A VV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMULCPH ymm1{k1}{z}, ymm2, AVX512VL ymm_2 and complex conjugate of 
ymm3/m256/m32bcst ymm3/m256/m32bcst, and store the result in 
ymm1 subject to writemask k1. 
EVEX.512.F2.MAP6.WO D6 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFCMULCPH zmm1{k1}{z}, zmm2, zmm2 and complex conjugate of 
zmm3/m512/m32bcst {er} zmm3/m512/m32bcst, and store the result in 
zmm1 subject to writemask k1. 
EVEX.128.F3.MAP6.WO D6 /r A VN AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMULCPH xmm1{k1}{z}, xmm2, AVX512VL xmme2 and xmm3/m128/m32bcst, and store the 
xmm3/m128/m32bcst result in xmm1 subject to writemask k1. 
EVEX.256.F3.MAP6.WO D6 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMULCPH ymm1{k1}{z}, ymm2, AVX512VL ymme2 and ymm3/m256/m32bcst, and store the 
ymm3/m256/m32bcst result in ymm1 subject to writemask k1. 
EVEX.512.F3.MAP6.WO D6 /r A VIV AVX512-FP16 Complex multiply a pair of FP16 values from 
VFMULCPH zmm1{k1}{z}, zmm2, zmm2 and zmm3/m512/m32bcst, and store the 
zmm3/m512/m32bcst {er} result in zmm1 subject to writemask k1. 
Instruction Operand Encoding 
Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Full ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) N/A 
Description 


This instruction performs a complex multiply operation. There are normal and complex conjugate forms of the oper- 


ation. The broadcasting and masking for this operation is done on 32-bit quantities representing a pair of FP16 


values. 


Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep- 
tions are masked. MXCSR status bits are updated to reflect exceptional conditions. 


Operation 


VFCMULCPH dest{k1}, src1, src2 (AVX512) 
VL = 128, 256 or 512 


KL := VL/32 


FOR i := 0 to KL-1: 


IF k1[i] or *no writemask*: 


IF broadcasting and src2 is memory: 

tsrc2.fp16[2*i+0] := src2.fp16[0] 
tsrc2.fp16[2*i+1] := src2.fp16[1] 
ELSE: 
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0] 
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1] 


FOR i := 0 to KL-1: 


VFCMULCPH/VFMULCPH—Complex Multiply FP16 Values 


Vol.2C 5-175 


INSTRUCTION SET REFERENCE, V 


IF k1[i] or *no writemask*: 
tmp.fp16[2*i+0] := src1.fp16[2*i+0] * tsrc2.fp16[2*i+0] 
tmp.fp16[2*i+1] := src1.fp16[2*i+1] * tsrc2.fp16[2*i+0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
// conjugate version subtracts odd final term 
dest.fp16[2*i] := tmp.fp16[2*i+0] +src1.fp16[2*i+1] * tsrc2.fp16[2*i+1] 
dest.fp16[2*i+1] := tmp.fp16[2*i+1] - src1.fp16[2*i+0] * tsrc2.fp16[2*i+1] 
ELSE IF *zeroing*: 
dest.fp16[2*i+0] := 0 
dest.fp16[2*i+1] := 0 


DEST[MAXVL-1:VL] := 0 


VFMULCPH dest{k1}, src1, src2 (AVX512) 
VL = 128, 256 or 512 
KL := VL/32 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 

IF broadcasting and src2 is memory: 
tsrc2.fp16[2*i+0] := src2.fp16[0] 
tsrc2.fp16[2*i+1] = src2.fp16[1] 

ELSE: 
tsrc2.fp16[2*i+0] := src2.fp16[2*i+0] 
tsrc2.fp16[2*i+1] := src2.fp16[2*i+1] 


FOR i := O to KI-1: 
IF k1[i] or *no writemask*: 
tmp.fp16[2*i+0] := src1.fp16[2*i+0] * tsrc2.fp16[2*i+0] 
tmp.fp16[2*i+1] := src1.fp16[2*i+1] * tsrc2.fp16[2*i+0] 


FOR i := 0 to KL-1: 
IF k1[i] or *no writemask*: 
// non-conjugate version subtracts last even term 
dest.fp16[2*i+0] := tmp.fp16[2*i+0] - src1.fp16[2*i+1] * tsrc2.fp16[2*i+1] 
dest.fp16[2*i+1] := tmp.fp16[2*i+1] + src1.fp16[2*i+0] * tsrc2.fp16[2*i+ 1] 
ELSE IF *zeroing*: 
dest.fp16[2*i+0] := 0 
dest.fp16[2*i+1] := 0 


DEST[MAXVL-1:VL] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFCMULCPH __m128h __mm_cmul_pch (__m128ha,__m128h b); 
VFCMULCPH __m128h __mm_mask_cmul_pch (__m128h src,__ mmask8 k,__m128ha,_m128h b); 
VFCMULCPH __m128h __mm_maskz_cmul_pch (__mmask8 k,___m128h a,_m128h b); 

VFCMULCPH __m256h __mm256_cmul_pch (__m256h a, ___ m256h b); 

VFCMULCPH __m256h _mm256_mask_cmul_pch (__m256h src, ___ mmask8 k,___ m256h a,___m256h b); 
VFCMULCPH __m256h __mm256_maskz_cmul_pch (__mmask8 k,___ m256h a, ___m256h b); 
VFCMULCPH __m512h_mm512_cmul_pch (_m512ha,__m512hb); 
VFCMULCPH __m512h _mm512_mask_cmul_pch (__m512h src, ___ mmask16 k, 
VFCMULCPH __m512h _mm512_maskz_cmul_pch (__mmask16 k,__m512ha, 


m512ha, 
m512h b); 


m512h b); 
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mm512_cmul_round_pch (__m512ha,__m512hb, const int rounding); 


m512h 


mm512_mask_cmul_round_pch (__m512h src, __ mmask16 k,__m512ha,__m512hb, const int rounding); 


m512h 


mm512_maskz_cmul_round_pch (__mmask16 k,__m512ha,__m512hb, const int rounding); 


m128h 


mm_fcmul_pch (__m128h a,__m128h b); 


m128h 


mm_mask_fcmul_pch (__m128h src,__ mmask8 k,__m128ha,__m128h b); 


m128h 


m256h 


mm_maskz_fcmul_pch (__mmask8 k,__m128ha,__m128h b); 
mm256_fcmul_pch (__m256h a, __m256h b); 


m256h 


mm256_mask_fcmul_pch (__m256h src,___ mmask8 k,__ m256h a, __m256h b); 


m256h 


mm256_maskz_fcmul_pch (__mmask8 k,___ m256h a,__ m256h b); 


m512h 


mm512_fcmul_pch (_m512ha,__m512hb); 


m512h 


mm512_mask_fcmul_pch (__m512h src,__ mmask16 k,__m512ha,_m512hb); 


m512h 


mm512_maskz_fcmul_pch (__mmask16 k,__m512ha,__m512hb); 


m512h 


m512h 


mm512_fcmul_round_pch (__m512ha,__m512hb, const int rounding); 
mm512_mask_fcmul_round_pch (__m512h src, __mmask16 k,__m512ha,__m512h, const int rounding); 


m512h 


mm512_maskz_fcmul_round_pch (__mmask16 k,__m512ha,__m512hb, const int rounding); 


m128h 


mm_fmul_pch (__m128h a, ___m128h b); 


VFMULCPH 


m128h 


mm_mask_fmul_pch (__m128h src,___ mmask8 k,__m128ha,__m128h b); 


VFMULCPH 


m128h 


mm_maskz_fmul_pch (__mmask8 k,__m128h a,___m128h b); 


VFMULCPH 


m256h 


VFMULCPH 


m256h 


mm256_fmul_pch (_m256h a,__m256h b); 
mm256_mask_fmul_pch (__m256h src, ___mmask8 k,__ m256h a,__ m256h b); 


VFMULCPH 


m256h 


mm256_maskz_fmul_pch (__mmask8 k,__ m256h a,__m256h b); 


VFMULCPH 


m512h 


mm512_fmul_pch (_m512ha,__m512hb); 


VFMULCPH 


m512h 


mm512_mask_fmul_pch (__m512h src, ___mmask16 k,__m512ha,__m512hb); 


VFMULCPH 


m512h 


mm512_maskz_fmul_pch (__mmask16 k,__m512ha,__m512hb); 


VFMULCPH 


m512h 


mm512_fmul_round_pch (__m512ha,__m512h b, const int rounding); 


VFMULCPH 


m512h 


VFMULCPH 


m512h 


mm512_mask_fmul_round_pch (__m512h src,__ mmask16 k,__m512ha,__m512hb, const int rounding); 
mm512_maskz_fmul_round_pch (__mmask16 k,__m512ha,__m512hb, const int rounding); 


VFMULCPH 


m128h 


mm_mask_mul_pch (__m128h src, ___mmask8 k,__m128h a,__m128h b); 


VFMULCPH 


m128h 


mm_maskz_mul_pch (__mmask8 k,___m128ha,__m128h b); 


VFMULCPH 


m128h 


mm_mul_pch (__m128h a, __m128h b); 


VFMULCPH 


m256h 


mm256_mask_mul_pch (__m256h src, ___mmask8 k,__ m256h a, ___m256h b); 


VFMULCPH 


m256h 


mm256_maskz_mul_pch (__mmask8 k,___m256h a,__ m256h b); 


VFMULCPH 


m256h 


VFMULCPH 


m512h 


mm256_mul_pch (__m256h a, __ m256h b); 


mm512_mask_mul_pch (__m512h src, ___ mmask16 k,__m512ha,__m512h b); 


VFMULCPH 


m512h 


mm512_maskz_mul_pch (__mmask16 k,__m512ha,__m512hb); 


VFMULCPH 


m512h 


mm512_mul_pch (_m512ha,__m512hb); 


VFMULCPH 


m512h 


mm512_mask_mul_round_pch (__m512h src,__ mmask16 k,__m512ha,__m512h b, const int rounding); 


VFMULCPH 


m512h 


mm512_maskz_mul_round_pch (__mmask16 k,__m512ha,__m512hb, const int rounding); 


VFMULCPH 


m512h 


mm512_mul_round_pch (__m512ha,__m512hb, const int rounding); 


SIMD Floating-Point Exceptions 


Invalid, Underflow, Overflow, Precision, Denormal. 


Other Exceptions 

EVEX-encoded instructions, see Table 2-49, “Type E4 Class Exception Conditions.” 
Additionally: 

#UD If (dest_reg == srcl_reg) or (dest_reg == src2_reg). 
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VFCMULCSH xmm1{k1}{z}, xmm2, 
xmm3/m32 {er} 


Opcode/ Op/ | 64/32 CPUID Feature Description 
Instruction En Bit Mode 
Support 
EVEX.LLIG.F2.MAP6.WO D7 /r A VV Complex multiply a pair of FP16 values from 


xmme2 and complex conjugate of xmm3/m32, and 
store the result in xmm1 subject to writemask k1. 
Bits 127:32 of xmm2 are copied to 
xmm1[127:32]. 


EVEX.LLIG.F3.MAP6.WO D7 /r A VN 
VFMULCSH xmm1{k1}{z}, xmm_2, 
xmm3/m32 {er} 


Complex multiply a pair of FP16 values from 
xmm_2 and xmm3/m32, and store the result in 
xmm1 subject to writemask k1. Bits 127:32 of 
xmm_2 are copied to xmm1[127:32]. 


Instruction Operand Encoding 


Op/En Tuple Operand 1 Operand 2 Operand 3 Operand 4 
A Scalar ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) N/A 
Description 


This instruction performs a complex multiply operation. There are normal and complex conjugate forms of the oper- 
ation. The masking for this operation is done on 32-bit quantities representing a pair of FP16 values. 


Bits 127:32 of the destination operand are copied from the corresponding bits of the first source operand. Bits 
MAXVL-1:128 of the destination operand are zeroed. The low FP16 element of the destination is updated according 


to the writemask. 


Rounding is performed at every FMA (fused multiply and add) boundary. Execution occurs as if all MXCSR excep- 
tions are masked. MXCSR status bits are updated to reflect exceptional conditions. 


Operation 


VFCMULCSH dest{k1}, src, src2 (AVX512) 
KL :=VL/ 32 


IF k1[0] or *no writemask*: 
tmp.fp16[0] := src1.fp16[0] * src2.fp16[0] 
tmp.fp16[1] := src1.fp16[1] * src2.fp16[0] 


// conjugate version subtracts odd final term 

dest.fp16[0] := tmp.fp16[0] + src1.fp16[1] * src2.fp16[1] 

dest.fp16[1] := tmp.fp16[1] - src1.fp16[0] * src2.fp16[1] 
ELSE IF *zeroing*: 

dest.fp16[0] := 0 

dest.fp16[1] := 0 


DEST[1 27:32] := src1[127:32] // copy upper part of src 
DEST[MAXVL-1:1 28] := 0 
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VFMULCSH dest{k1}, src1, src2 (AVX512) 


KL:= VL/ 32 


IF k1[0] or *no writemask*: 
// non-conjugate version subtracts last even term 
tmp.fp16[0] := src1.fp16[0] * src2.fp16[0] 
tmp.fp16[1] := src1.fp16[1] * src2.fp16[0] 
dest.fp16[0] := tmp.fp16[0] - src1.fp16[1] * src2.fp16[1] 
dest.fp16[1] := tmp.fp16[1] + src1.fp16[0] * src2.fp16[1] 

ELSE IF *zeroing*: 
dest.fp16[0] := 0 
dest.fp16[1] := 0 


DEST[1 27:32] := src1[127:32] // copy upper part of src 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 
VFCMULCSH 


VFMULCSH 


m128h 


mm 


cmul_round_sch (__m128h a,__m128h b, const int rounding); 


m128h 


mm. 


mask_cmul_round_sch (__m128h src,___ mmask8 k,___m128ha,__m128h b, const int rounding); 


m128h 


mm 


maskz_cmul_round_sch (__mmask8 k,___m128ha,__m128hb, const int rounding); 


m128h 


mm. 


cmul_sch (__m128h a,__m128h b); 


m128h 


mm 


mask_cmul_sch (__m128h src, ___ mmask8 k,__m128h a,_m128h b); 


m128h 


mm. 


maskz_cmul_sch (__mmask8 k,___m128ha,__m128hb); 


m128h 


mm 


m128h 


mm 


fcmul_round_sch (__m128h a,__m128h b, const int rounding); 
mask_fcmul_round_sch (__m128h src,__mmask8 k,__m128ha,_m128h b, const int rounding); 


m128h 


mm 


maskz_fcmul_round_sch (__mmask8 k,__m128h a, ___m128h }, const int rounding); 


m128h 


mm. 


fcmul_sch (__m128h a,__m128h b); 


m128h 


mm 


mask_fcmul_sch (__m128h src,__ mmask8 k,__m128ha,__m128h b); 


m128h 


mm 


maskz_fcmul_sch (__mmask8 k,___m128h a, ___m128h b); 


m128h 


mm. 


VFMULCSH 


m128h 


mm. 


fmul_round_sch (__m128h a, __m128h , const int rounding); 
mask_fmul_round_sch (__m128h src, ___mmask8 k,__m128ha,_m128h, const int rounding); 


VFMULCSH 


m128h 


mm. 


maskz_fmul_round_sch (__mmask8 k,___m128ha,__m128hb, const int rounding); 


VFMULCSH 


m128h 


mm. 


fmul_sch (__m128h a, ___m128h b); 


VFMULCSH 


m128h 


mm. 


mask_fmul_sch (__m128h src, ___mmask8 k,__m128h a,__m128h b); 


VFMULCSH 


m128h 


mm. 


maskz_fmul_sch (__mmask8 k,___m128h a, __m128h b); 


VFMULCSH 


m128h 


mm. 


mask_mul_round_sch (__m128h src,__ mmask8 k,__m128ha,__m128h b, const int rounding); 


VFMULCSH 


m128h 


mm. 


VFMULCSH 


m128h 


mm. 


maskz_mul_round_sch (__mmask8 k,___m128ha,__m128h b, const int rounding); 
mul_round_sch (__m128ha,__m128hb, const int rounding); 


VFMULCSH 


m128h 


mm. 


mask_mul_sch (__m128h src,__ mmask8 k,__m128ha,_m128h b); 


VFMULCSH 


m128h 


mm. 


maskz_mul_sch (__mmask8 k,___m128h a,_m128h b); 


VFMULCSH 


m128h 


mm. 


mul_sch (__m128h a,__m128h b); 


SIMD Floating-Point Exceptions 


Invalid, Underflow, Overflow, Precision, Denormal. 


Other Exceptions 
EVEX-encoded instructions, see Table 2-58, “Type E10 Class Exception Conditions.” 
Additionally: 


#UD 
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If ( 


dest_reg == srci1_reg) or (dest_reg == src2_reg). 
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VGETMANTSS—E€Extract Float32 Vector of Normalized Mantissa From Float32 Scalar 


Opcode/ Op/ | 64/32 CPUID Description 
Instruction En BitMode | Feature 
Support | Flag 
EVEX.LLIG.66.0F3A.WO 27 /r ib A VIN AVX512F Extract the normalized mantissa from the low float32 
VGETMANTSS xmm1 {k1}{z}, xmm_z, element of xmm3/m32 using imm8 for sign control and 
xmm3/m32{sae}, imm8 mantissa interval normalization, store the mantissa to 
xmm1 under the writemask k1 and merge with the 
other elements of xmm2. 


Instruction Operand Encoding 


Op/En Tuple Type Operand 1 Operand 2 Operand 3 Operand 4 
A Tuple1 Scalar ModRM:reg (w) EVEX.vvvv (r) ModRM:r/m (r) N/A 
Description 


Convert the single-precision floating values in the low doubleword element of the second source operand (the third 
operand) to single-precision floating-point value with the mantissa normalization and sign control specified by the 
imm8 byte, see Figure 5-15. The converted result is written to the low doubleword element of the destination 
operand (the first operand) using writemask k1. Bits (127:32) of the XMM register destination are copied from 
corresponding bits in the first source operand. The normalized mantissa is specified by interv (imm8[1:0]) and the 
sign control (sc) is specified by bits 3:2 of the immediate byte. 


The conversion operation is: 


GetMant(x) = +2|x.significand| 
where: 


1 <= |x.significand| < 2 


Unbiased exponent k can be either 0 or -1, depending on the interval range defined by interv, the range of the 
significand and whether the exponent of the source is even or odd. The sign of the final result is determined by sc 
and the source sign. The encoded value of imm8[1:0] and sign control are shown in Figure 5-15. 


The converted single-precision floating-point result is encoded according to the sign control, the unbiased expo- 
nent k (adding bias) and a mantissa normalized to the range specified by interv. 


The GetMant() function follows Table 5-8 when dealing with floating-point special numbers. 


If writemasking is used, the low doubleword element of the destination operand is conditionally updated depending 
on the value of writemask register k1. If writemasking is not used, the low doubleword element of the destination 
operand is unconditionally updated. 


5-384 Vol. 2C VGETMANTSS—Extract Float32 Vector of Normalized Mantissa From Float32 Scalar 
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// getmant_fp32(src, sign_control, normalization_interval) is defined in the operation section of VGETMANTPS 


VGETMANTSS (EVEX encoded version) 
SignCtrl[1:0] := IMM8[3:2]; 


Interv[1:0] := IMM8[1:0]; 


IF k1[0] OR *no writemask* 


THEN DEST[31:0] := 


getmant_fp32(src, sign_control, normalization_interval) 


ELSE 


IF *merging-masking* 


ELSE 


Fl 
Fl; 


; merging-masking 
THEN *DEST[31:0] remains unchanged* 
; zeroing-masking 


DEST[31:0] := 0 


DEST[127:32] := SRC1[127:32] 
DEST[MAXVL-1:128] = 0 


Intel C/C++ Compiler Intrinsic Equivalent 


VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 
VGETMANTSS 


getmant_ss(__m128 a,__m128 b, enum intv, enum sgn); 
mask_getmant_ss(__m128s,__mmask8 k,__m128 a,__m128 b, enum intv, enum sgn); 


m128 b, enum intv, enum sgn); 


getmant_round_ss(__m128 a,__m128 b, enum intv, enum sgn, int r); 


m128s,__mmask8 k,__m128 a, 


mi28_mm 

mi28_mm 

m128 __mm_maskz_getmant_ss(__mmask8 k,__m128 a, 
mi28_mm 

m128 _mm_mask_getmant_round_ss( 

m128 __mm_maskz_getmant_round_ss( 


mmask8 k,___m128 a,__m128 b, enum intv, enum sgn, int r); 


SIMD Floating-Point Exceptions 


Denormal, Invalid 


Other Exceptions 
See Table 2-47, “Type E3 Class Exception Conditions.” 


VGETMANTSS—Extract Float32 Vector of Normalized Mantissa From Float32 Scalar 


m128 b, enum intv, enum sgn, int r); 
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VPBLENDD—Blend Packed Dwords 


Opcode/ Op/ 64/32 | CPUID Description 
Instruction En -bit Feature 
Mode | Flag 
VEX.128.66.0F3A.WO O2 /r ib RVMI | V/V AVX2 Select dwords from xmm2 and xmm3/m128 from 
VPBLENDD xmm1, xmm2, xmm3/m128, imm8 mask specified in imm8 and store the values into 
xmm1. 
VEX.256.66.0F3A.WO O2 /r ib RVMI | V/V AVX2 Select dwords from ymm2 and ymm3/m256 from 
VPBLENDD ymm1, ymm2, ymm3/m256, imm8 mask specified in imm8 and store the values into 
ymm1. 


Instruction Operand Encoding 


Op/En Operand 1 Operand 2 Operand 3 Operand 4 
RVMI ModRM:reg (w) VEX.vvvv (r) ModRM:r/m (r) imm8 
Description 


Dword elements from the source operand (second operand) are conditionally written to the destination operand 
(first operand) depending on bits in the immediate operand (third operand). The immediate bits (bits 7:0) forma 
mask that determines whether the corresponding dword in the destination is copied from the source. If a bit in the 
mask, corresponding to a dword, is “1", then the dword is copied, else the dword is unchanged. 

VEX.128 encoded version: The second source operand can be an XMM register or a 128-bit memory location. The 
first source and destination operands are XMM registers. Bits (MAXVL-1:128) of the corresponding YMM register 
are zeroed. 

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register 
or a 256-bit memory location. The destination operand is a YMM register. 


Operation 


VPBLENDD (VEX.256 encoded version) 

IF (imm8[0] == 1) THEN DEST[31:0] := SRC2[31:0] 

ELSE DEST[31:0] := SRC1[31:0] 

IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32] 

ELSE DEST[63:32] := SRC1[63:32] 

IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64] 

ELSE DEST[95:64] := SRC1[95:64] 

IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96] 
ELSE DEST[1 27:96] := SRC1[127:96] 

IF (imm8[4] == 1) THEN DEST[159:128] := SRC2[159:128] 
ELSE DEST[159:128] := SRC1[159:128] 

IF (imm8[5] == 1) THEN DEST[191:160] := SRC2[191:160] 
ELSE DEST[191:160] := SRC1[191:160] 

IF (imm8[6] == 1) THEN DEST[223:192] := SRC2[223:192] 
ELSE DEST[223:192] := SRC1[223:192] 

IF (imm8[7] == 1) THEN DEST[255:224] := SRC2[255:224] 
ELSE DEST[255:224] := SRC1[255:224] 
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VPBLENDD (VEX.128 encoded version) 

IF (imm8[O] == 1) THEN DEST[31:0] := SRC2[31:0] 
ELSE DEST[31:0] := SRC1[31:0] 

IF (imm8[1] == 1) THEN DEST[63:32] := SRC2[63:32] 
ELSE DEST[63:32] := SRC1[63:32] 

IF (imm8[2] == 1) THEN DEST[95:64] := SRC2[95:64] 
ELSE DEST[95:64] := SRC1[95:64] 

IF (imm8[3] == 1) THEN DEST[127:96] := SRC2[127:96] 
ELSE DEST[127:96] := SRC1[127:96] 
DEST[MAXVL-1:128] := 0 


Intel C/C++ Compiler Intrinsic Equivalent 
VPBLENDD: m128i __mm_blend_epi32 (__m128i v1,__m128i v2, const int mask) 
VPBLENDD: m256i __mm256_blend_epi32 (__m256i v1, 


m256i v2, const int mask) 


SIMD Floating-Point Exceptions 
None. 


Other Exceptions 

See Table 2-21, “Type 4 Class Exception Conditions.” 
Additionally: 

#UD If VEX.W = 1. 


VPBLENDD—Blend Packed Dwords 
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8. Updates to Chapter 1, Volume 3A 


Change bars and violet text show changes to Chapter 1 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A: System Programming Guide, Part 1. 


Changes to this chapter: 


e Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processors to 
the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.” 
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CHAPTER 1 
ABOUT THIS MANUAL 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A: System Programming Guide, Part 
1 (order number 253668), the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B: System 
Programming Guide, Part 2 (order number 253669), the Intel® 64 and IA-32 Architectures Software Developer's 
Manual, Volume 3C: System Programming Guide, Part 3 (order number 326019), and the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 3D:System Programming Guide, Part 4 (order number 
332831) are part of a set that describes the architecture and programming environment of Intel 64 and IA-32 
Architecture processors. The other volumes in this set are: 


* Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (order number 
253665). 


¢ Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D: Instruction Set 
Reference (order numbers 253666, 253667, 326018, and 334569). 


° = =The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers 
(order number 335592). 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture 
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describe the instruction set of the processor and the opcode struc- 
ture. These volumes apply to application programmers and to programmers who write operating systems or exec- 
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describe 
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating- 
system and BIOS designers. In addition, Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
3B, and Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C, address the programming 
environment for classes of software that host operating systems. The Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 4, describes the model-specific registers of Intel 64 and IA-32 processors. 


1.1 INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL 


This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which 
include: 


* Pentium® processors 

° P6 family processors 

* Pentium® 4 processors 

* Pentium® M processors 

* Intel® Xeon® processors 

* Pentium® D processors 

* Pentium® processor Extreme Editions 

* 64-bit Intel® Xeon® processors 

* Intel® Core™ Duo processor 

* Intel® Core™ Solo processor 

* Dual-Core Intel® Xeon® processor LV 

* Intel® Core™ 2 Duo processor 

* Intel® Core™ 2 Quad processor Q6000 series 
* Intel® xeon® processor 3000, 3200 series 
* Intel® Xeon® processor 5000 series 

* Intel® xeon® processor 5100, 5300 series 
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* Intel® Core™ 2 Extreme processor X7000 and X6800 series 
* Intel® Core™ 2 Extreme QX6000 series 

* Intel® Xeon® processor 7100 series 

* Intel® Pentium® Dual-Core processor 

* Intel® Xeon® processor 7200, 7300 series 

* Intel® Core™ 2 Extreme QX9000 series 

* Intel® Xeon® processor 5200, 5400, 7400 series 

* Intel® Core™ 2 Extreme processor QX9000 and X9000 series 
* Intel® Core™ 2 Quad processor Q9000 series 

* Intel® Core™ 2 Duo processor E8000, T9000 series 


* Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are built from 45 nm and 32 nm processes. 


* Intel® Core™ i7 processor 

* Intel® Core™ i5 processor 

* Intel® Xeon® processor E7-8800/4800/2800 product families 
* Intel® Core™ i7-3930K processor 

* 2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series 
* Intel® Xeon® processor E3-1200 product family 

* Intel® Xeon® processor E5-2400/1400 product family 

* Intel® Xeon® processor E5-4600/2600/1600 product family 
* 3rd generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1200 v2 product family 

* Intel® Xeon® processor E5-2400/1400 v2 product families 

* Intel® Xeon® processor E5-4600/2600/1600 v2 product families 
* Intel® Xeon® processor E7-8800/4800/2800 v2 product families 
* 4th generation Intel® Core™ processors 

* The Intel® Core™ M processor family 

* Intel® Core™ i7-59xx Processor Extreme Edition 

* Intel® Core™ i7-49xx Processor Extreme Edition 

* Intel® Xeon® processor E3-1200 v3 product family 

* Intel® Xeon® processor E5-2600/1600 v3 product families 

* 5th generation Intel® Core™ processors 

* Intel® Xeon® processor D-1500 product family 

* Intel® Xeon® processor E5 v4 family 

* Intel Atom® processor X7-Z8000 and X5-Z8000 series 

* Intel Atom® processor Z3400 series 

* Intel Atom® processor Z3500 series 

* 6th generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1500m v5 product family 

* 7th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series 

* Intel® Xeon® Scalable Processor Family 

* 8th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 
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* Intel® Xeon® E processors 

* 9th generation Intel® Core™ processors 

* 2nd generation Intel® Xeon® Scalable Processor Family 
* 10th generation Intel® Core™ processors 

* 11th generation Intel® Core™ processors 

* 3rd generation Intel® Xeon® Scalable Processor Family 
* 12th generation Intel® Core™ processors 

* 13th generation Intel® Core™ processors 

* 4th generation Intel® Xeon® Scalable Processor Family 
* 5th generation Intel® Xeon® Scalable Processor Family 
* Intel® Core™ Ultra 7 processors 


P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium® 
Pro, Pentium® II, Pentium® III, and Pentium® III Xeon® processors. 


The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® micro- 
architecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon 
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture. 


The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved 
Pentium® M processor microarchitecture. 


The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Quad, and Intel® Core™ 2 Extreme processors are based on Intel® Core™ microar- 
chitecture. 


The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™ 2 Quad processor Q9000 series, and Intel® 
Core™ 2 Extreme processors QX9000, X9000 series, Intel® Core™ 2 processor E8000 series are based on 
Enhanced Intel® Core™ microarchitecture. 


The Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are based on the Intel Atom® microarchitecture and supports Intel 64 architecture. 


P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV, 
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® Atom™ 
processor Z5xx series support IA-32 architecture. 


The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Extreme, Intel® Core™ 2 Quad processors, Pentium® D processors, Pentium® Dual- 
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture. 


The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem 
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel® 
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the 
Westmere microarchitecture. These processors support Intel 64 architecture. 


The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7- 
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx, 
Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product 
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support 
Intel 64 architecture. 


The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2 
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec- 
ture and support Intel 64 architecture. 


The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on 
the Haswell microarchitecture and support Intel 64 architecture. 
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The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme 
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture. 


The Intel Atom® processor Z8000 series is based on the Airmont microarchitecture. 


The Intel Atom® processor Z3400 series and the Intel Atom® processor Z3500 series are based on the Silvermont 
microarchitecture. 


The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500 
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® Scalable Processor Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener- 
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture. 


The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64 
architecture. 


The Intel Atom® processor C series, the Intel Atom® processor X series, the Intel® Pentium® processor J series, 
the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Goldmont 
microarchitecture. 


The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and 
supports Intel 64 architecture. 


The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron® 
processor N series are based on the Goldmont Plus microarchitecture. 


The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces- 
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture. 


The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and 
supports Intel 64 architecture. 


The 2nd generation Intel® Xeon® Scalable Processor Family is based on the Cascade Lake product and supports 
Intel 64 architecture. 


Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based 
on the Comet Lake microarchitecture; both support Intel 64 architecture. 


Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are 
based on the Rocket Lake microarchitecture; both support Intel 64 architecture. 


Some 3rd generation Intel® Xeon® Scalable Processor Family processors are based on the Cooper Lake product, 
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture. 


The 12th generation Intel® Core™ processors supporting Alder Lake performance hybrid architecture support Intel 
64 architecture. 


The 13th generation Intel® Core™ processors are based on the Raptor Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and 
supports Intel 64 architecture. 


The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and 
supports Intel 64 architecture. 


The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and supports Intel 64 architecture. 


IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces- 
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset 
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture. 


Le OVERVIEW OF THE SYSTEM PROGRAMMING GUIDE 


A description of this manual’s content follows!: 
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Chapter 1 — About This Manual. Gives an overview of all volumes of the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual. It also describes the notational conventions in these manuals and lists related Intel 
manuals and documentation of interest to programmers and hardware designers. 


Chapter 2 — System Architecture Overview. Describes the modes of operation used by Intel 64 and IA-32 
processors and the mechanisms provided by the architectures to support operating systems and executives, 
including the system-oriented registers and data structures and the system-oriented instructions. The steps neces- 
sary for switching between real-address and protected modes are also identified. 


Chapter 3 — Protected-Mode Memory Management. Describes the data structures, registers, and instructions 
that support segmentation and paging. The chapter explains how they can be used to implement a “flat” (unseg- 
mented) memory model or a segmented memory model. 


Chapter 4 — Paging. Describes the paging modes supported by Intel 64 and IA-32 processors. 


Chapter 5 — Protection. Describes the support for page and segment protection provided in the Intel 64 and IA- 
32 architectures. This chapter also explains the implementation of privilege rules, stack switching, pointer valida- 
tion, user mode, and supervisor mode. 


Chapter 6 — Interrupt and Exception Handling. Describes the basic interrupt mechanisms defined in the Intel 
64 and IA-32 architectures, shows how interrupts and exceptions relate to protection, and describes how the archi- 
tecture handles each exception type. Reference information for each exception is given in this chapter. Includes 
programming the LINTO and LINT1 inputs and gives an example of how to program the LINTO and LINT1 pins for 
specific interrupt vectors. 


Chapter 7 — User Interrupts. Describes user interrupts supported by Intel 64 and IA-32 processors. 


Chapter 8 — Task Management. Describes mechanisms the Intel 64 and IA-32 architectures provide to support 
multitasking and inter-task protection. 


Chapter 9 — Multiple-Processor Management. Describes the instructions and flags that support multiple 
processors with shared memory, memory ordering, and Intel® Hyper-Threading Technology. Includes MP initializa- 
tion for P6 family processors and gives an example of how to use the MP protocol to boot P6 family processors in 
an MP system. 


Chapter 10 — Processor Management and Initialization. Defines the state of an Intel 64 or IA-32 processor 
after reset initialization. This chapter also explains how to set up an Intel 64 or IA-32 processor for real-address 
mode operation and protected- mode operation, and how to switch between modes. 


Chapter 11 — Advanced Programmable Interrupt Controller (APIC). Describes the programming interface 
to the local APIC and gives an overview of the interface between the local APIC and the I/O APIC. Includes APIC bus 
message formats and describes the message formats for messages transmitted on the APIC bus for P6 family and 
Pentium processors. 


Chapter 12 — Memory Cache Control. Describes the general concept of caching and the caching mechanisms 
supported by the Intel 64 or IA-32 architectures. This chapter also describes the memory type range registers 
(MTRRs) and how they can be used to map memory types of physical memory. Information on using the new cache 
control and memory streaming instructions introduced with the Pentium III, Pentium 4, and Intel Xeon processors 
is also given. 


Chapter 13 — Intel® MMX™ Technology System Programming. Describes those aspects of the Intel® MMxX™ 
technology that must be handled and considered at the system programming level, including: task switching, 
exception handling, and compatibility with existing system environments. 


Chapter 14 — System Programming For Instruction Set Extensions And Processor Extended States. 
Describes the operating system requirements to support SSE/SSE2/SSE3/SSSE3/SSE4 extensions, including task 
switching, exception handling, and compatibility with existing system environments. The latter part of this chapter 
describes the extensible framework of operating system requirements to support processor extended states. 
Processor extended state may be required by instruction set extensions beyond those of 
SSE/SSE2/SSE3/SSSE3/SSE4 extensions. 


Chapter 15 — Power and Thermal Management. Describes facilities of Intel 64 and IA-32 architecture used for 
power management and thermal monitoring. 


1. Model-Specific Registers have been moved out of this volume and into a separate volume: Intel® 64 and IA-32 Architectures Soft- 
ware Developer's Manual, Volume 4. 
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Chapter 16 — Machine-Check Architecture. Describes the machine-check architecture and machine-check 
exception mechanism found in the Pentium 4, Intel Xeon, and P6 family processors. Additionally, a signaling mech- 
anism for software to respond to hardware corrected machine check error is covered. 


Chapter 17 — Interpreting Machine-Check Error Codes. Gives an example of how to interpret the error codes 
for a machine-check error that occurred on a P6 family processor. 


Chapter 18 — Debug, Branch Profile, TSC, and Resource Monitoring Features. Describes the debugging 
registers and other debug mechanism provided in Intel 64 or IA-32 processors. This chapter also describes the 
time-stamp counter. 


Chapter 19 — Last Branch Records. Describes the Last Branch Records (architectural feature). 


Chapter 20 — Performance Monitoring. Describes the Intel 64 and IA-32 architectures’ facilities for monitoring 
performance. 


Chapter 21 — 8086 Emulation. Describes the real-address and virtual-8086 modes of the IA-32 architecture. 


Chapter 22 — Mixing 16-Bit and 32-Bit Code. Describes how to mix 16-bit and 32-bit code modules within the 
same program or task. 


Chapter 23 — IA-32 Architecture Compatibility. Describes architectural compatibility among IA-32 proces- 
sors. 


Chapter 24 — Introduction to Virtual Machine Extensions. Describes the basic elements of virtual machine 
architecture and the virtual machine extensions for Intel 64 and IA-32 Architectures. 


Chapter 25 — Virtual Machine Control Structures. Describes components that manage VMX operation. These 
include the working-VMCS pointer and the controlling-VMCS pointer. 


Chapter 26 — VMX Non-Root Operation. Describes the operation of a VMX non-root operation. Processor oper- 
ation in VMX non-root mode can be restricted programmatically such that certain operations, events or conditions 
can cause the processor to transfer control from the guest (running in VMX non-root mode) to the monitor software 
(running in VMX root mode). 


Chapter 27 — VM Entries. Describes VM entries. VM entry transitions the processor from the VMM running in VMX 
root-mode to a VM running in VMX non-root mode. VM-Entry is performed by the execution of VMLAUNCH or VMRE- 
SUME instructions. 


Chapter 28 — VM Exits. Describes VM exits. Certain events, operations or situations while the processor is in VMX 
non-root operation may cause VM-exit transitions. In addition, VM exits can also occur on failed VM entries. 


Chapter 29 — VMX Support for Address Translation. Describes virtual-machine extensions that support 
address translation and the virtualization of physical memory. 


Chapter 30 — APIC Virtualization and Virtual Interrupts. Describes the VMCS including controls that enable 
the virtualization of interrupts and the Advanced Programmable Interrupt Controller (APIC). 


Chapter 31 — VMX Instruction Reference. Describes the virtual-machine extensions (VMX). VMX is intended 
for a system executive to support virtualization of processor hardware and a system software layer acting as a host 
to multiple guest software environments. 


Chapter 32 — System Management Mode. Describes Intel 64 and IA-32 architectures’ system management 
mode (SMM) facilities. 


Chapter 33 — Intel® Processor Trace. Describes details of Intel® Processor Trace. 


Chapter 34 — Introduction to Intel® Software Guard Extensions. Provides an overview of the Intel® Soft- 
ware Guard Extensions (Intel® SGX) set of instructions. 


Chapter 35 — Enclave Access Control and Data Structures. Describes Enclave Access Control procedures and 
defines various Intel SGX data structures. 


Chapter 36 — Enclave Operation. Describes enclave creation and initialization, adding pages and measuring an 
enclave, and enclave entry and exit. 


Chapter 37 — Enclave Exiting Events. Describes enclave-exiting events (EEE) and asynchronous enclave exit 
(AEX). 


Chapter 38 — SGX Instruction References. Describes the supervisor and user level instructions provided by 
Intel SGX. 
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Chapter 39 — Intel® SGX Interactions with IA32 and Intel® 64 Architecture. Describes the Intel SGX 
collection of enclave instructions for creating protected execution environments on processors supporting IA32 and 
Intel 64 architectures. 


Chapter 40 — Enclave Code Debug and Profiling. Describes enclave code debug processes and options. 


Appendix A — VMX Capability Reporting Facility. Describes the VMX capability MSRs. Support for specific VMX 
features is determined by reading capability MSRs. 


Appendix B — Field Encoding in VMCS. Enumerates all fields in the VMCS and their encodings. Fields are 
grouped by width (16-bit, 32-bit, etc.) and type (guest-state, host-state, etc.). 


Appendix C — VM Basic Exit Reasons. Describes the 32-bit fields that encode reasons for a VM exit. Examples 
of exit reasons include, but are not limited to: software interrupts, processor exceptions, software traps, NMIs, 
external interrupts, and triple faults. 


1.3 NOTATIONAL CONVENTIONS 


This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for 
hexadecimal and binary numbers. A review of this notation makes the manual easier to read. 


1.3.1 Bit and Byte Order 


In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses 
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to 

two raised to the power of the bit position. Intel 64 and IA-32 processors are “little endian” machines; this means 
the bytes of a word are numbered starting from the least significant byte. Figure 1-1 illustrates these conventions. 


1.32 Reserved Bits and Software Compatibility 


In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as 
reserved, it is essential for compatibility with future processors that software treat these bits as having a future, 
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict- 
able. Software should follow these guidelines in dealing with reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers which contain such bits. 
Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 


¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, 
or reload them with values previously read from the same register. 


NOTE 


Avoid any software dependence upon the state of reserved bits in Intel 64 and IA-32 registers. 
Depending upon the values of reserved register bits will make software dependent upon the 
unspecified manner in which the processor handles these bits. Programs that depend upon 
reserved values risk incompatibility with future processors. 
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Data Structure 


Highest ., 24 23 16 15 8 7 0 ~<— Bit offset 


Address 


Lowest 
Address 


Byte Offset 


Figure 1-1. Bit and Byte Order 


1.3.3 Instruction Operands 


When instructions are represented symbolically, a subset of assembly language is used. In this subset, an instruc- 
tion has the following format: 
label: mnemonic argument1, argument2, arqument3 
where: 
¢ A label is an identifier which is followed by a colon. 
¢ A mnemonic is a reserved name for a class of instruction opcodes which have the same function. 


° The operands argumenti, argument2, and argument3 are optional. There may be from zero to three 
operands, depending on the opcode. When present, they take the form of either literals or identifiers for data 
items. Operand identifiers are either reserved names of registers or are assumed to be assigned to data items 
declared in another part of the program (which may not be shown in the example). 


When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left 
operand is the destination. 


For example: 


LOADREG: MOV EAX, SUBTOTAL 


In this example LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand, 
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order. 


1.3.4 Hexadecimal and Binary Numbers 


Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for 
example, F82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, 
E, and F. 


Base 2 (binary) numbers are represented by a string of 1s and Os, sometimes followed by the character B (for 
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might 
arise. 


1.3.5 Segmented Addressing 


The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes. 
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes memory. The 
range of memory that can be addressed is called an address space. 
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The processor also supports segmented addressing. This is a form of addressing where a program may have many 
independent address spaces, called segments. For example, a program can keep its code (instructions) and stack 
in separate segments. Code addresses would always refer to the code space, and stack addresses would always 
refer to the stack space. The following notation is used to specify a byte address within a segment: 


Segment-register: Byte-address 
For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS 
register: 

DS:FF79H 
The following segment address identifies an instruction address in the code segment. The CS register points to the 
code segment and the EIP register contains the address of the instruction. 


CS:EIP 


1.3.6 Syntax for CPUID, CR, and MSR Values 


Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register 
bits, and by reading model-specific registers. We are moving toward a single syntax to represent this type of infor- 
mation. See Figure 1-2. 


CPUID Input and Output 


CPUID.01H:EDX.SSE[bit 25] = 1 
, 


Input value for EAX register 


Output register and feature flag or field 
name with bit position(s) 


Value (or range) of output 


Control Register Values 


CR4.OSFXSR)Ibit 9] = 1 


Example CR name 


Feature flag or field name 
with bit position(s) 


Value (or range) of output 


Model-Specific Register Values 


IA32_MISC_ENABLE.ENABLEFOPCODE[bit 2] = 1 


Example MSR name 


Feature flag or field name with bit position(s) 


Value (or range) of output 


Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation 


Vol. 3A 1-9 


ABOUT THIS MANUAL 


13.7 Exceptions 


An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to 
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi- 
tions. Some types of exceptions may provide error codes. An error code reports additional information about the 
error. An example of the notation used to show an exception and error code is shown below: 

#PF(fault code) 


This example refers to a page-fault exception under conditions where an error code naming a type of fault is 
reported. Under some conditions, exceptions which produce error codes may not be able to report an accurate 
code. In this case, the error code is zero, as shown below for a general-protection exception: 


#GP(0) 


1.4 RELATED LITERATURE 


Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at: 
https://software.intel.com/en-us/articles/intel-sdm 
See also: 


* The latest security information on Intel® products: 
https://www. intel.com/content/www/us/en/security-center/default.html 


¢ Software developer resources, guidance, and insights for security advisories: 
https://software.intel.com/security-software-guidance/ 


¢ The data sheet for a particular Intel 64 or IA-32 processor 
° The specification update for a particular Intel 64 or IA-32 processor 


* Intel® C++ Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


* Intel® Fortran Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


* Intel® Software Development Tools: 
https://software.intel.com/en-us/intel-sdp-home 


* Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four or ten volumes): 
https://software.intel.com/en-us/articles/intel-sdm 


* Intel® 64 and IA-32 Architectures Optimization Reference Manual: 
https://software.intel.com/en-us/articles/intel-sdm#optimization 


* Intel® Trusted Execution Technology Measured Launched Environment Programming Guide: 
http://www. intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html 


* Intel® Software Guard Extensions (Intel® SGX) Information 
https://software.intel.com/en-us/isa-extensions/intel-sgx 


* Developing Multi-threaded Applications: A Platform Consistent Approach: 
https://software.intel.com/sites/default/files/article/147714/51534-developing-multithreaded-applica- 
tions. pdf 


* Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor: 
https://software.intel.com/sites/default/files/22/30/25602 


° Performance Monitoring Unit Sharing Guide 
http://software.intel.com/file/30388 


Literature related to select features in future Intel processors are available at: 


* Intel® Architecture Instruction Set Extensions Programming Reference 
https://software.intel.com/en-us/isa-extensions 


More relevant links are: 
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Intel® Developer Zone: 

https://software.intel.com/en-us 

Developer centers: 

http://www. intel.com/content/www/us/en/hardware-developers/developer-centers.html 
Processor support general link: 

http://www. intel.com/support/processors/ 

Intel® Hyper-Threading Technology (Intel® HT Technology): 

http://www. intel.com/technology/platform-technology/hyper-threading/index.htm 
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9. Updates to Chapter 2, Volume 3A 


Change bars and violet text show changes to Chapter 2 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A: System Programming Guide, Part 1. 


Changes to this chapter: 
e Updated Figure 2-7, “Control Registers,” to add the LA57 bit to the CR4 register (bit 12). 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 
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CHAPTER 2 
SYSTEM ARCHITECTURE OVERVIEW 


IA-32 architecture (beginning with the Intel386 processor family) provides extensive support for operating-system 
and system-development software. This support offers multiple modes of operation, which include: 


° Real mode, protected mode, virtual 8086 mode, and system management mode. These are sometimes 
referred to as legacy modes. 


Intel 64 architecture supports almost all the system programming facilities available in IA-32 architecture and 
extends them to a new operating mode (IA-32e mode) that supports a 64-bit programming environment. IA-32e 
mode allows software to operate in one of two sub-modes: 


* 64-bit mode supports 64-bit OS and 64-bit applications 

* Compatibility mode allows most legacy software to run; it co-exists with 64-bit applications under a 64-bit OS. 
The IA-32 system-level architecture includes features to assist in the following operations: 
¢ Memory management. 

¢ Protection of software modules. 

° Multitasking. 

¢ Exception and interrupt handling. 

* Multiprocessing. 

* Cache management. 

¢ Hardware resource and power management. 

® Debugging and performance monitoring. 


This chapter provides a description of each part of this architecture. It also describes the system registers that are 
used to set up and control the processor at the system level and gives a brief overview of the processor’s system- 
level (Operating system) instructions. 


Many features of the system-level architecture are used only by system programmers. However, application 
programmers may need to read this chapter and the following chapters in order to create a reliable and secure 
environment for application programs. 


This overview and most subsequent chapters of this book focus on protected-mode operation of the IA-32 architec- 
ture. IA-32e mode operation of the Intel 64 architecture, as it differs from protected mode operation, is also 
described. 


All Intel 64 and IA-32 processors enter real-address mode following a power-up or reset (see Chapter 10, 
“Processor Management and Initialization”). Software then initiates the switch from real-address mode to 
protected mode. If IA-32e mode operation is desired, software also initiates a switch from protected mode to IA- 
32e mode. 


2.1 OVERVIEW OF THE SYSTEM-LEVEL ARCHITECTURE 


System-level architecture consists of a set of registers, data structures, and instructions designed to support basic 
system-level operations such as memory management, interrupt and exception handling, task management, and 
control of multiple processors. 


Figure 2-1 provides a summary of system registers and data structures that applies to 32-bit modes. System regis- 
ters and data structures that apply to IA-32e mode are shown in Figure 2-2. 
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Figure 2-1. IA-32 System-Level Registers and Data Structures 
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Figure 2-2. System-Level Registers and Data Structures in |A-32e Mode and 4-Level Paging 


2.1.1 Global and Local Descriptor Tables 


When operating in protected mode, all memory accesses pass through either the global descriptor table (GDT) or 
an optional local descriptor table (LDT) as shown in Figure 2-1. These tables contain entries called segment 


descriptors. Segment descriptors provide the base address of segments well as access rights, type, and usage 
information. 
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Each segment descriptor has an associated segment selector. A segment selector provides the software that uses 
it with an index into the GDT or LDT (the offset of its associated segment descriptor), a global/local flag (deter- 
mines whether the selector points to the GDT or the LDT), and access rights information. 


To access a byte in a segment, a segment selector and an offset must be supplied. The segment selector provides 
access to the segment descriptor for the segment (in the GDT or LDT). From the segment descriptor, the processor 
obtains the base address of the segment in the linear address space. The offset then provides the location of the 
byte relative to the base address. This mechanism can be used to access any valid code, data, or stack segment, 
provided the segment is accessible from the current privilege level (CPL) at which the processor is operating. The 
CPL is defined as the protection level of the currently executing code segment. 


See Figure 2-1. The solid arrows in the figure indicate a linear address, dashed lines indicate a segment selector, 
and the dotted arrows indicate a physical address. For simplicity, many of the segment selectors are shown as 
direct pointers to a segment. However, the actual path from a segment selector to its associated segment is always 
through a GDT or LDT. 


The linear address of the base of the GDT is contained in the GDT register (GDTR); the linear address of the LDT is 
contained in the LDT register (LDTR). 


2.1.1.1 Global and Local Descriptor Tables in |A-32e Mode 


GDTR and LDTR registers are expanded to 64-bits wide in both IA-32e sub-modes (64-bit mode and compatibility 
mode). For more information: see Section 3.5.2, “Segment Descriptor Tables in IA-32e Mode.” 


Global and local descriptor tables are expanded in 64-bit mode to support 64-bit base addresses, (16-byte LDT 
descriptors hold a 64-bit base address and various attributes). In compatibility mode, descriptors are not 
expanded. 


2lve System Segments, Segment Descriptors, and Gates 


Besides code, data, and stack segments that make up the execution environment of a program or procedure, the 
architecture defines two system segments: the task-state segment (TSS) and the LDT. The GDT is not considered 
a segment because it is not accessed by means of a segment selector and segment descriptor. TSSs and LDTs have 
segment descriptors defined for them. 


The architecture also defines a set of special descriptors called gates (call gates, interrupt gates, trap gates, and 
task gates). These provide protected gateways to system procedures and handlers that may operate at a different 
privilege level than application programs and most procedures. For example, a CALL to a call gate can provide 
access to a procedure in a code segment that is at the same or a numerically lower privilege level (more privileged) 
than the current code segment. To access a procedure through a call gate, the calling procedure! supplies the 
selector for the call gate. The processor then performs an access rights check on the call gate, comparing the CPL 
with the privilege level of the call gate and the destination code segment pointed to by the call gate. 


If access to the destination code segment is allowed, the processor gets the segment selector for the destination 
code segment and an offset into that code segment from the call gate. If the call requires a change in privilege 
level, the processor also switches to the stack for the targeted privilege level. The segment selector for the new 
stack is obtained from the TSS for the currently running task. Gates also facilitate transitions between 16-bit and 
32-bit code segments, and vice versa. 


2.1.2.1 Gates in IA-32e Mode 


In IA-32e mode, the following descriptors are 16-byte descriptors (expanded to allow a 64-bit base): LDT descrip- 
tors, 64-bit TSSs, call gates, interrupt gates, and trap gates. 


Call gates facilitate transitions between 64-bit mode and compatibility mode. Task gates are not supported in IA- 
32e mode. On privilege level changes, stack segment selectors are not read from the TSS. Instead, they are set to 
NULL. 


1. The word “procedure” is commonly used in this document as a general term for a logical unit or block of code (such as a program, pro- 
cedure, function, or routine). 
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2.1.3 Task-State Segments and Task Gates 


The TSS (see Figure 2-1) defines the state of the execution environment for a task. It includes the state of general- 
purpose registers, segment registers, the EFLAGS register, the EIP register, and segment selectors with stack 
pointers for three stack segments (one stack for each privilege level). The TSS also includes the segment selector 
for the LDT associated with the task and the base address of the paging-structure hierarchy. 


All program execution in protected mode happens within the context of a task (called the current task). The 
segment selector for the TSS for the current task is stored in the task register. The simplest method for switching 
to a task is to make a call or jump to the new task. Here, the segment selector for the TSS of the new task is given 
in the CALL or JMP instruction. In switching tasks, the processor performs the following actions: 


Stores the state of the current task in the current TSS. 
Loads the task register with the segment selector for the new task. 
Accesses the new TSS through a segment descriptor in the GDT. 


h WN 


Loads the state of the new task from the new TSS into the general-purpose registers, the segment registers, 
the LDTR, control register CR3 (base address of the paging-structure hierarchy), the EFLAGS register, and the 
EIP register. 


5. Begins execution of the new task. 


A task can also be accessed through a task gate. A task gate is similar to a call gate, except that it provides access 
(through a segment selector) to a TSS rather than a code segment. 


213.1 Task-State Segments in |A-32e Mode 


Hardware task switches are not supported in IA-32e mode. However, TSSs continue to exist. The base address of 
a TSS is specified by its descriptor. 


A 64-bit TSS holds the following information that is important to 64-bit operation: 
¢ Stack pointer addresses for each privilege level. 

¢ Pointer addresses for the interrupt stack table. 

° Offset address of the IO-permission bitmap (from the TSS base). 


The task register is expanded to hold 64-bit base addresses in IA-32e mode. See also: Section 8.7, “Task Manage- 
ment in 64-bit Mode.” 


2.1.4 Interrupt and Exception Handling 


External interrupts, software interrupts and exceptions are handled through the interrupt descriptor table (IDT). 
The IDT stores a collection of gate descriptors that provide access to interrupt and exception handlers. Like the 
GDT, the IDT is not a segment. The linear address for the base of the IDT is contained in the IDT register (IDTR). 


Gate descriptors in the IDT can be interrupt, trap, or task gate descriptors. To access an interrupt or exception 
handler, the processor first receives an interrupt vector from internal hardware, an external interrupt controller, or 
from software by means of an INT n, INTO, INT3, INT1, or BOUND instruction. The interrupt vector provides an 
index into the IDT. If the selected gate descriptor is an interrupt gate or a trap gate, the associated handler proce- 
dure is accessed in a manner similar to calling a procedure through a call gate. If the descriptor is a task gate, the 
handler is accessed through a task switch. 


2.1.4.1 Interrupt and Exception Handling IA-32e Mode 


In IA-32e mode, interrupt gate descriptors are expanded to 16 bytes to support 64-bit base addresses. This is true 
for 64-bit mode and compatibility mode. 


The IDTR register is expanded to hold a 64-bit base address. Task gates are not supported. 
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2.1.5 Memory Management 


System architecture supports either direct physical addressing of memory or virtual memory (through paging). 
When physical addressing is used, a linear address is treated as a physical address. When paging is used: all code, 
data, stack, and system segments (including the GDT and IDT) can be paged with only the most recently accessed 
pages being held in physical memory. 


The location of pages (sometimes called page frames) in physical memory is contained in the paging structures. 
These structures reside in physical memory (see Figure 2-1 for the case of 32-bit paging). 


The base physical address of the paging-structure hierarchy is contained in control register CR3. The entries in the 
paging structures determine the physical address of the base of a page frame, access rights and memory manage- 
ment information. 


To use this paging mechanism, a linear address is broken into parts. The parts provide separate offsets into the 
paging structures and the page frame. A system can have a single hierarchy of paging structures or several. For 
example, each task can have its own hierarchy. 


2.1.5.1 Memory Management in IA-32e Mode 


In IA-32e mode, physical memory pages are managed by a set of system data structures. In both compatibility 
mode and 64-bit mode, four or five levels of system data structures are used (see Chapter 4, “Paging”). These 
include the following: 


° The page map level 5 (PMLS5) — An entry in the PML5 table contains the physical address of the base of a 
PML4 table, access rights, and memory management information. The base physical address of the PML5 table 
is stored in CR3. The PMLS table is used only with 5-level paging. 


¢ A page map level 4 (PML4) — An entry in a PML4 table contains the physical address of the base of a page 
directory pointer table, access rights, and memory management information. With 4-level paging, there is only 
one PML4 table and its base physical address is stored in CR3. 


° <A set of page directory pointer tables — An entry in a page directory pointer table contains the physical 
address of the base of a page directory table, access rights, and memory management information. 

° Sets of page directories — An entry in a page directory table contains the physical address of the base of a 
page table, access rights, and memory management information. 


° Sets of page tables — An entry in a page table contains the physical address of a page frame, access rights, 
and memory management information. 


2.1.6 System Registers 

To assist in initializing the processor and controlling system operations, the system architecture provides system 

flags in the EFLAGS register and several system registers: 

¢ The system flags and IOPL field in the EFLAGS register control task and mode switching, interrupt handling, 
instruction tracing, and access rights. See also: Section 2.3, “System Flags and Fields in the EFLAGS Register.” 


¢ The control registers (CRO, CR2, CR3, and CR4) contain a variety of flags and data fields for controlling system- 
level operations. Other flags in these registers are used to indicate support for specific processor capabilities 
within the operating system or executive. See also: Chapter 2, “Control Registers,” and Section 2.6, “Extended 
Control Registers (Including XCRO).” 


¢ The debug registers (not shown in Figure 2-1) allow the setting of breakpoints for use in debugging programs 
and systems software. See also: Chapter 18, “Debug, Branch Profile, TSC, and Intel® Resource Director 
Technology (Intel® RDT) Features.” 


¢ The GDTR, LDTR, and IDTR registers contain the linear addresses and sizes (limits) of their respective tables. 
See also: Section 2.4, ‘Memory-Management Registers.” 


¢ The task register contains the linear address and size of the TSS for the current task. See also: Section 2.4, 
“Memory-Management Registers.” 


° Model-specific registers (not shown in Figure 2-1). 
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The model-specific registers (MSRs) are a group of registers available primarily to operating-system or executive 
procedures (that is, code running at privilege level 0). These registers control items such as the debug extensions, 
the performance-monitoring counters, the machine- check architecture, and the memory type ranges (MTRRs). 


The number and function of these registers varies among different members of the Intel 64 and IA-32 processor 
families. See also: Section 10.4, “Model-Specific Registers (MSRs),” and Chapter 2, “Model-Specific Registers 
(MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4. 


Most systems restrict access to system registers (other than the EFLAGS register) by application programs. 
Systems can be designed, however, where all programs and procedures run at the most privileged level (privilege 
level 0). In such a case, application programs would be allowed to modify the system registers. 


2.1.6.1 System Registers in |A-32e Mode 


In IA-32e mode, the four system-descriptor-table registers (GDTR, IDTR, LDTR, and TR) are expanded in hardware 
to hold 64-bit base addresses. EFLAGS becomes the 64-bit RFLAGS register. CRO-CR4 are expanded to 64 bits. 
CR8 becomes available. CR8 provides read-write access to the task priority register (TPR) so that the operating 
system can control the priority classes of external interrupts. 


In 64-bit mode, debug registers DRO-DR7 are 64 bits. In compatibility mode, address-matching in DRO-DR3 is 
also done at 64-bit granularity. 


On systems that support IA-32e mode, the extended feature enable register (IA32_EFER) is available. This model- 
specific register controls activation of IA-32e mode and other IA-32e mode operations. In addition, there are 
several model-specific registers that govern IA-32e mode instructions: 


° IA32_KERNEL_GS_BASE — Used by SWAPGS instruction. 
° IA32_LSTAR — Used by SYSCALL instruction. 

° IA32_FMASK — Used by SYSCALL instruction. 

® IA32_STAR — Used by SYSCALL and SYSRET instruction. 


2.1.7 Other System Resources 


Besides the system registers and data structures described in the previous sections, system architecture provides 
the following additional resources: 


* Operating system instructions (see also: Section 2.8, “System Instruction Summary”). 
¢ Performance-monitoring counters (not shown in Figure 2-1). 
¢ Internal caches and buffers (not shown in Figure 2-1). 


Performance-monitoring counters are event counters that can be programmed to count processor events such as 
the number of instructions decoded, the number of interrupts received, or the number of cache loads. 


The processor provides several internal caches and buffers. The caches are used to store both data and instruc- 
tions. The buffers are used to store things like decoded addresses to system and application segments and write 
operations waiting to be performed. See also: Chapter 12, “Memory Cache Control.” 


2.2 MODES OF OPERATION 


The IA-32 architecture supports three operating modes and one quasi-operating mode: 


¢ Protected mode — This is the native operating mode of the processor. It provides a rich set of architectural 
features, flexibility, high performance and backward compatibility to existing software base. 


¢ Real-address mode — This operating mode provides the programming environment of the Intel 8086 
processor, with a few extensions (such as the ability to switch to protected or system management mode). 


¢ System management mode (SMM) — SMM is a standard architectural feature in all IA-32 processors, 
beginning with the Intel386 SL processor. This mode provides an operating system or executive with a 
transparent mechanism for implementing power management and OEM differentiation features. SMM is 
entered through activation of an external system interrupt pin (SMI#), which generates a system management 
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interrupt (SMI). In SMM, the processor switches to a separate address space while saving the context of the 
currently running program or task. SMM-specific code may then be executed transparently. Upon returning 
from SMM, the processor is placed back into its state prior to the SMI. 


° Virtual-8086 mode — In protected mode, the processor supports a quasi-operating mode known as virtual- 
8086 mode. This mode allows the processor execute 8086 software in a protected, multitasking environment. 


Intel 64 architecture supports all operating modes of IA-32 architecture and IA-32e modes: 


® IA-32e mode — In IA-32e mode, the processor supports two sub-modes: compatibility mode and 64-bit 
mode. 64-bit mode provides 64-bit linear addressing and support for physical address space larger than 64 
GBytes. Compatibility mode allows most legacy protected-mode applications to run unchanged. 


Figure 2-3 shows how the processor moves between operating modes. 


SMI# 
Real-Address 
Mode 
Reset 
or 
Reset or _ RSM 
a] Pert 
SMI# 
Reset > 
ia RSM System 
Management 
LME=1, CRO.PG=1* onary Mode 


A 
See** 
=1 


_ 
~Rsm 
VM=0 VM= 
* See Section 10.8.5 
irtual-8086 See Section 10.8.5.4 


Mode 


Figure 2-3. Transitions Among the Processor’s Operating Modes 


The processor is placed in real-address mode following power-up or a reset. The PE flag in control register CRO then 
controls whether the processor is operating in real-address or protected mode. See also: Section 10.9, “Mode 
Switching,” and Section 4.1.2, “Paging-Mode Enabling.” 


The VM flag in the EFLAGS register determines whether the processor is operating in protected mode or virtual- 
8086 mode. Transitions between protected mode and virtual-8086 mode are generally carried out as part of a task 
switch or a return from an interrupt or exception handler. See also: Section 21.2.5, “Entering Virtual-8086 Mode.” 


The LMA bit (IA32_EFER.LMA[bit 10]) determines whether the processor is operating in IA-32e mode. When 
running in IA-32e mode, 64-bit or compatibility sub-mode operation is determined by CS.L bit of the code segment. 
The processor enters into IA-32e mode from protected mode by enabling paging and setting the LME bit 
(IA32_EFER.LME[bit 8]). See also: Chapter 10, “Processor Management and Initialization.” 


The processor switches to SMM whenever it receives an SMI while the processor is in real-address, protected, 
virtual-8086, or IA-32e modes. Upon execution of the RSM instruction, the processor always returns to the mode 
it was in when the SMI occurred. 
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Extended Feature Enable Register 


The IA32_EFER MSR provides several fields related to IA-32e mode enabling and operation. It also provides one 
field that relates to page-access right modification (see Section 4.6, “Access Rights”). The layout of the IA32_EFER 
MSR is shown in Figure 2-4. 


63 121110 9 8 7 1. 0 


IA32_EFER 


Execute Disable Bit Enable 


IA-32e Mode Active 


IA-32e Mode Enable 


SYSCALL Enable 


Reserved 
Figure 2-4. IA32_EFER MSR Layout 
Table 2-1. 1A32_EFER MSR Information 

Bit Description 
0 SYSCALL Enable: IA32_EFER.SCE (R/W) 

Enables SYSCALL/SYSRET instructions in 64-bit mode. 
7 Reserved. 
8 IA-32e Mode Enable: IA32_EFER.LME (R/wW) 

Enables IA-32e mode operation. 
9 Reserved. 
10 IA-32e Mode Active: IA32_EFER.LMA (R) 

Indicates IA-32e mode is active when set. 
11 Execute Disable Bit Enable: [A32_EFER.NXE (R/W) 

Enables page access restriction by preventing instruction fetches from PAE pages with the XD bit set (See Section 4.6). 
63:12 Reserved. 

2.3 SYSTEM FLAGS AND FIELDS IN THE EFLAGS REGISTER 


The system flags and IOPL field of the EFLAGS register control I/O, maskable hardware interrupts, debugging, task 
switching, and the virtual-8086 mode (see Figure 2-5). Only privileged code (typically operating system or execu- 
tive code) should be allowed to modify these bits. 


The system flags and IOPL are: 


TF 


Trap (bit 8) — Set to enable single-step mode for debugging; clear to disable single-step mode. In single- 
step mode, the processor generates a debug exception after each instruction. This allows the execution 
state of a program to be inspected after each instruction. If an application program sets the TF flag using a 
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IF 


IOPL 


NT 


RF 


VM 


POPF, POPFD, or IRET instruction, a debug exception is generated after the instruction that follows the 
POPF, POPFD, or IRET. 


31 22 212019 18 17 16 15 14131211109 876543210 
Reserved (set to 0) VVfalviglols| © folo)s|r}s|ztolalole) 4c 
Df afejcime lit] p JFlFlFlFlF/FiOlF| lr] ‘TF 


ID —Identification Flag 

VIP — Virtual Interrupt Pending 
VIF — Virtual Interrupt Flag 
AC — Alignment Check / Access Control —— 
VM — Virtual-8086 Mode 
RF — Resume Flag 
NT — Nested Task Flag 
IOPL— I/O Privilege Level 
IF — Interrupt Enable Flag 
TF — Trap Flag 


Reserved 


Figure 2-5. System Flags in the EFLAGS Register 


Interrupt enable (bit 9) — Controls the response of the processor to maskable hardware interrupt 
requests (see also: Section 6.3.2, “Maskable Hardware Interrupts”). The flag is set to respond to maskable 
hardware interrupts; cleared to inhibit maskable hardware interrupts. The IF flag does not affect the gener- 
ation of exceptions or nonmaskable interrupts (NMI interrupts). The CPL, IOPL, and the state of the VME 
flag in control register CR4 determine whether the IF flag can be modified by the CLI, STI, POPF, POPFD, 
and IRET. 


I/O privilege level field (bits 12 and 13) — Indicates the I/O privilege level (IOPL) of the currently 
running program or task. The CPL of the currently running program or task must be less than or equal to 
the IOPL to access the I/O address space. The POPF and IRET instructions can modify this field only when 
operating at a CPL of 0. 


The IOPL is also one of the mechanisms that controls the modification of the IF flag and the handling of 
interrupts in virtual-8086 mode when virtual mode extensions are in effect (when CR4.VME = 1). See also: 
Chapter 19, “Input/Output,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1. 


Nested task (bit 14) — Controls the chaining of interrupted and called tasks. The processor sets this flag 
on calls to a task initiated with a CALL instruction, an interrupt, or an exception. It examines and modifies 
this flag on returns from a task initiated with the IRET instruction. The flag can be explicitly set or cleared 
with the POPF/POPFD instructions; however, changing to the state of this flag can generate unexpected 
exceptions in application programs. 


See also: Section 8.4, “Task Linking.” 


Resume (bit 16) — Controls the processor’s response to instruction-breakpoint conditions. When set, this 
flag temporarily disables debug exceptions (#DB) from being generated for instruction breakpoints 
(although other exception conditions can cause an exception to be generated). When clear, instruction 
breakpoints will generate debug exceptions. 


The primary function of the RF flag is to allow the restarting of an instruction following a debug exception 
that was caused by an instruction breakpoint condition. Here, debug software must set this flag in the 
EFLAGS image on the stack just prior to returning to the interrupted program with IRETD (to prevent the 
instruction breakpoint from causing another debug exception). The processor then automatically clears 
this flag after the instruction returned to has been successfully executed, enabling instruction breakpoint 
faults again. 


See also: Section 18.3.1.1, “Instruction-Breakpoint Exception Condition.” 
Virtual-8086 mode (bit 17) — Set to enable virtual-8086 mode; clear to return to protected mode. 
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See also: Section 21.2.1, “Enabling Virtual-8086 Mode.” 


AC Alignment check or access control (bit 18) — If the AM bit is set in the CRO register, alignment 
checking of user-mode data accesses is enabled if and only if this flag is 1. An alignment-check exception 
is generated when reference is made to an unaligned operand, such as a word at an odd byte address or a 
doubleword at an address which is not an integral multiple of four. Alignment-check exceptions are gener- 
ated only in user mode (privilege level 3). Memory references that default to privilege level 0, such as 
segment descriptor loads, do not generate this exception even when caused by instructions executed in 
user-mode. 


The alignment-check exception can be used to check alignment of data. This is useful when exchanging 
data with processors which require all data to be aligned. The alignment-check exception can also be used 
by interpreters to flag some pointers as special by misaligning the pointer. This eliminates overhead of 
checking each pointer and only handles the special pointer when used. 


If the SMAP bit is set in the CR4 register, explicit supervisor-mode data accesses to user-mode pages are 
allowed if and only if this bit is 1. See Section 4.6, “Access Rights.” 


VIF Virtual Interrupt (bit 19) — Contains a virtual image of the IF flag. This flag is used in conjunction with 
the VIP flag. The processor only recognizes the VIF flag when either the VME flag or the PVI flag in control 
register CR4 is set and the IOPL is less than 3. (The VME flag enables the virtual-8086 mode extensions; 
the PVI flag enables the protected-mode virtual interrupts.) 


See also: Section 21.3.3.5, “Method 6: Software Interrupt Handling,” and Section 21.4, “Protected-Mode 
Virtual Interrupts.” 


VIP Virtual interrupt pending (bit 20) — Set by software to indicate that an interrupt is pending; cleared to 
indicate that no interrupt is pending. This flag is used in conjunction with the VIF flag. The processor reads 
this flag but never modifies it. The processor only recognizes the VIP flag when either the VME flag or the 
PVI flag in control register CR4 is set and the IOPL is less than 3. The VME flag enables the virtual-8086 
mode extensions; the PVI flag enables the protected-mode virtual interrupts. 


See Section 21.3.3.5, “Method 6: Software Interrupt Handling,” and Section 21.4, “Protected-Mode Virtual 
Interrupts.” 


ID Identification (bit 21) — The ability of a program or procedure to set or clear this flag indicates support 
for the CPUID instruction. 


2.3.1 System Flags and Fields in |A-32e Mode 


In 64-bit mode, the RFLAGS register expands to 64 bits with the upper 32 bits reserved. System flags in RFLAGS 
(64-bit mode) or EFLAGS (compatibility mode) are shown in Figure 2-5. 


In IA-32e mode, the processor does not allow the VM bit to be set because virtual-8086 mode is not supported 
(attempts to set the bit are ignored). Also, the processor will not set the NT bit. The processor does, however, allow 
software to set the NT bit (note that an IRET causes a general protection fault in IA-32e mode if the NT bit is set). 


In IA-32e mode, the SYSCALL/SYSRET instructions have a programmable method of specifying which bits are 
cleared in RFLAGS/EFLAGS. These instructions save/restore EFLAGS/RFLAGS. 


2.4 MEMORY-MANAGEMENT REGISTERS 


The processor provides four memory-management registers (GDTR, LDTR, IDTR, and TR) that specify the locations 
of the data structures which control segmented memory management (see Figure 2-6). Special instructions are 
provided for loading and storing these registers. 
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System Table Registers 


47(79) 1615 0 
GDTR 32(64)-bit Linear Base Address 16-Bit Table Limit 
IDTR 32(64)-bit Linear Base Address 16-Bit Table Limit 
System Segment Segment Descriptor Registers (Automatically Loaded) 
Registers 
15 0 Attributes 
eae Seg. Sel. 32(64)-bit Linear Base Address Segment Limit 
LDTR Seg. Sel. 32(64)-bit Linear Base Address Segment Limit 


Figure 2-6. Memory Management Registers 


2.4.1 Global Descriptor Table Register (GDTR) 


The GDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and the 16-bit table 
limit for the GDT. The base address specifies the linear address of byte 0 of the GDT; the table limit specifies the 
number of bytes in the table. 


The LGDT and SGDT instructions load and store the GDTR register, respectively. On power up or reset of the 
processor, the base address is set to the default value of 0 and the limit is set to OFFFFH. A new base address must 
be loaded into the GDTR as part of the processor initialization process for protected-mode operation. 


See also: Section 3.5.1, “Segment Descriptor Tables.” 


2.4.2 Local Descriptor Table Register (LDTR) 


The LDTR register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e 
mode), segment limit, and descriptor attributes for the LDT. The base address specifies the linear address of byte 
0 of the LDT segment; the segment limit specifies the number of bytes in the segment. See also: Section 3.5.1, 
“Segment Descriptor Tables.” 


The LLDT and SLDT instructions load and store the segment selector part of the LDTR register, respectively. The 
segment that contains the LDT must have a segment descriptor in the GDT. When the LLDT instruction loads a 
segment selector in the LDTR: the base address, limit, and descriptor attributes from the LDT descriptor are auto- 
matically loaded in the LDTR. 


When a task switch occurs, the LDTR is automatically loaded with the segment selector and descriptor for the LDT 
for the new task. The contents of the LDTR are not automatically saved prior to writing the new LDT information 
into the register. 


On power up or reset of the processor, the segment selector and base address are set to the default value of 0 and 
the limit is set to OFFFFH. 


2.4.3 IDTR Interrupt Descriptor Table Register 


The IDTR register holds the base address (32 bits in protected mode; 64 bits in IA-32e mode) and 16-bit table limit 
for the IDT. The base address specifies the linear address of byte O of the IDT; the table limit specifies the number 
of bytes in the table. The LIDT and SIDT instructions load and store the IDTR register, respectively. On power up or 
reset of the processor, the base address is set to the default value of 0 and the limit is set to OFFFFH. The base 
address and limit in the register can then be changed as part of the processor initialization process. 


See also: Section 6.10, “Interrupt Descriptor Table (IDT).” 
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2.4.4 Task Register (TR) 


The task register holds the 16-bit segment selector, base address (32 bits in protected mode; 64 bits in IA-32e 
mode), segment limit, and descriptor attributes for the TSS of the current task. The selector references the TSS 
descriptor in the GDT. The base address specifies the linear address of byte 0 of the TSS; the segment limit speci- 
fies the number of bytes in the TSS. See also: Section 8.2.4, “Task Register.” 


The LTR and STR instructions load and store the segment selector part of the task register, respectively. When the 
LTR instruction loads a segment selector in the task register, the base address, limit, and descriptor attributes from 
the TSS descriptor are automatically loaded into the task register. On power up or reset of the processor, the base 
address is set to the default value of 0 and the limit is set to OFFFFH. 


When a task switch occurs, the task register is automatically loaded with the segment selector and descriptor for 
the TSS for the new task. The contents of the task register are not automatically saved prior to writing the new TSS 
information into the register. 


rs CONTROL REGISTERS 


Control registers (CRO, CR1i, CR2, CR3, and CR4; see Figure 2-7) determine operating mode of the processor and 
the characteristics of the currently executing task. These registers are 32 bits in all 32-bit modes and compatibility 
mode. 


In 64-bit mode, control registers are expanded to 64 bits. The MOV CRn instructions are used to manipulate the 

register bits. Operand-size prefixes for these instructions are ignored. The following is also true: 

¢ The control registers can be read and loaded (or modified) using the move-to-or-from-control-registers forms 
of the MOV instruction. In protected mode, the MOV instructions allow the control registers to be read or loaded 
(at privilege level 0 only). This restriction means that application programs or operating-system procedures 
(running at privilege levels 1, 2, or 3) are prevented from reading or loading the control registers. 

¢ Some of the bits in CRO and CR4 are reserved and must be written with zeros. Attempting to set any reserved 
bits in CRO[31:0] is ignored. Attempting to set any reserved bits in CRO[63:32] results in a general-protection 
exception, #GP(0). Attempting to set any reserved bits in CR4 results in a general-protection exception, 
#GP(0). 

¢ All 64 bits of CR2 are writable by software. 

° Reserved bits in CR3[63:MAXPHYADDR] must be zero. Attempting to set any of them results in #GP(0). 

° The MOV CR2 instruction does not check that address written to CR2 is canonical. 


¢ A 64-bit capable processor will retain the upper 32 bits of each control register when transitioning out of IA-32e 
mode. 


* Ona 64-bit capable processor, an execution of MOV to CR outside of 64-bit mode zeros the upper 32 bits of the 
control register. 


° Register CR8 is available in 64-bit mode only. 


The control registers are summarized below, and each architecturally defined control field in these control registers 

is described individually. In Figure 2-7, the width of the register in 64-bit mode is indicated in parenthesis (except 

for CRO). 

¢ CRO — Contains system control flags that control operating mode and states of the processor. 

¢ CR1i — Reserved. 

¢ CR2 — Contains the page-fault linear address (the linear address that caused a page fault). 

¢ CR3 — Contains the physical address of the base of the paging-structure hierarchy and two flags (PCD and 
PWT). Only the most-significant bits (less the lower 12 bits) of the base address are specified; the lower 12 bits 
of the address are assumed to be 0. The first paging structure must thus be aligned to a page (4-KByte) 


boundary. The PCD and PWT flags control caching of that paging structure in the processor's internal data 
caches (they do not control TLB caching of page-directory information). 


When using the physical address extension, the CR3 register contains the base address of the page-directory- 
pointer table. With 4-level paging and 5-level paging, the CR3 register contains the base address of the PML4 
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table and PMLS table, respectively. If PCIDs are enabled, CR3 has a format different from that illustrated in 


Figure 2-7. See Section 4.5, “4-Level Paging and 5-Level Paging.” 


See also: Chapter 4, “Paging.” 


¢ CR4 — Contains a group of flags that enable several architectural extensions, and indicate operating system or 
executive support for specific processor capabilities. Bits CR4[63:32] can only be used for IA-32e mode only 
features that are enabled after entering 64-bit mode. Bits CR4[63:32] do not have any effect outside of IA-32e 


mode. 


* CR8 — Provides read and write access to the Task Priority Register (TPR). It specifies the priority threshold 
value that operating systems use to control the priority class of external interrupts allowed to interrupt the 
processor. This register is available only in 64-bit mode. However, interrupt filtering continues to apply in 


compatibility mode. 


Figure 2-7. Control Registers 
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The flags in control registers are: 
CRO.PG 


Paging (bit 31 of CRO) — Enables paging when set; disables paging when clear. When paging is 
disabled, all linear addresses are treated as physical addresses. The PG flag has no effect if the PE flag (bit 
0 of register CRO) is not also set; setting the PG flag when the PE flag is clear causes a general-protection 
exception (#GP). See also: Chapter 4, “Paging.” 


On Intel 64 processors, enabling and disabling IA-32e mode operation also requires modifying CRO.PG. 
CRO.CD 


Cache Disable (bit 30 of CRO) — When the CD and NW flags are clear, caching of memory locations for 
the whole of physical memory in the processor's internal (and external) caches is enabled. When the CD 
flag is set, caching is restricted as described in Table 12-5. To prevent the processor from accessing and 
updating its caches, the CD flag must be set and the caches must be invalidated so that no cache hits can 
occur. 


See also: Section 12.5.3, “Preventing Caching,” and Section 12.5, “Cache Control.” 


CRO.NW 
Not Write-through (bit 29 of CRO) — When the NW and CD flags are clear, write-back (for Pentium 4, 
Intel Xeon, P6 family, and Pentium processors) or write-through (for Intel486 processors) is enabled for 
writes that hit the cache and invalidation cycles are enabled. See Table 12-5 for detailed information about 
the effect of the NW flag on caching for other settings of the CD and NW flags. 


CRO.AM 
Alignment Mask (bit 18 of CRO) — Enables automatic alignment checking when set; disables alignment 
checking when clear. Alignment checking is performed only when the AM flag is set, the AC flag in the 
EFLAGS register is set, CPL is 3, and the processor is operating in either protected or virtual-8086 mode. 


CRO.WP 
Write Protect (bit 16 of CRO) — When set, inhibits supervisor-level procedures from writing into read- 
only pages; when clear, allows supervisor-level procedures to write into read-only pages (regardless of the 
U/S bit setting; see Section 4.1.3 and Section 4.6). This flag facilitates implementation of the copy-on- 
write method of creating a new process (forking) used by operating systems such as UNIX. This flag must 
be set before software can set CR4.CET, and it cannot be cleared as long as CR4.CET = 1 (see below). 


CRO.NE 
Numeric Error (bit 5 of CRO) — Enables the native (internal) mechanism for reporting x87 FPU errors 
when set; enables the PC-style x87 FPU error reporting mechanism when clear. When the NE flag is clear 
and the IGNNE# input is asserted, x87 FPU errors are ignored. When the NE flag is clear and the IGNNE# 
input is deasserted, an unmasked x87 FPU error causes the processor to assert the FERR# pin to generate 
an external interrupt and to stop instruction execution immediately before executing the next waiting 
floating-point instruction or WAIT/FWAIT instruction. 


The FERR# pin is intended to drive an input to an external interrupt controller (the FERR# pin emulates the 
ERROR# pin of the Intel 287 and Intel 387 DX math coprocessors). The NE flag, IGNNE# pin, and FERR# 
pin are used with external logic to implement PC-style error reporting. Using FERR# and IGNNE# to handle 
floating-point exceptions is deprecated by modern operating systems; this non-native approach also limits 
newer processors to operate with one logical processor active. 


See also: Section 8.7, “Handling x87 FPU Exceptions in Software,” in Chapter 8, “Programming with the 
x87 FPU,” and Appendix A, “EFLAGS Cross-Reference,” in the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 1. 


CRO.ET 
Extension Type (bit 4 of CRO) — Reserved in the Pentium 4, Intel Xeon, P6 family, and Pentium proces- 
sors. In the Pentium 4, Intel Xeon, and P6 family processors, this flag is hardcoded to 1. In the Intel386 
and Intel486 processors, this flag indicates support of Intel 387 DX math coprocessor instructions when 
set. 


CRO.TS 
Task Switched (bit 3 of CRO) — Allows the saving of the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 
context on a task switch to be delayed until an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction is 
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actually executed by the new task. The processor sets this flag on every task switch and tests it when 
executing x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions. 


¢ Ifthe TS flag is set and the EM flag (bit 2 of CRO) is clear, a device-not-available exception (#NM) is 
raised prior to the execution of any x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction; with the 
exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT. 
See the paragraph below for the special case of the WAIT/FWAIT instructions. 


¢ Ifthe TS flag is set and the MP flag (bit 1 of CRO) and EM flag are clear, an #NM exception is not raised 
prior to the execution of an x87 FPU WAIT/FWAIT instruction. 


¢ If the EM flag is set, the setting of the TS flag has no effect on the execution of x87 
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions. 


Table 2-2 shows the actions taken when the processor encounters an x87 FPU instruction based on the 
settings of the TS, EM, and MP flags. Table 13-1 and 14-1 show the actions taken when the processor 
encounters an MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction. 


The processor does not automatically save the context of the x87 FPU, XMM, and MXCSR registers on a 
task switch. Instead, it sets the TS flag, which causes the processor to raise an #NM exception whenever it 
encounters an x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction in the instruction stream for the 
new task (with the exception of the instructions listed above). 


The fault handler for the #NM exception can then be used to clear the TS flag (with the CLTS instruction) 
and save the context of the x87 FPU, XMM, and MXCSR registers. If the task never encounters an x87 
FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instruction, the x87 FPU/MMX/SSE/SSE2/SSE3/SSSE3/SSE4 
context is never saved. 


Table 2-2. Action Taken By x87 FPU Instructions for Different Combinations of EM, MP, and TS 


CRO Flags x87 FPU Instruction Type 

EM MP TS Floating-Point WAIT/FWAIT 
0 0 0 Execute Execute. 

0 0 1 #NM Exception Execute. 

0 1 0 Execute Execute. 

0 1 1 #NM Exception #NM exception. 
1 0 0 #NM Exception Execute. 

1 0 1 #NM Exception Execute. 

1 1 0 #NM Exception Execute. 

1 1 1 #NM Exception #NM exception. 

CRO.EM 


Emulation (bit 2 of CRO) — Indicates that the processor does not have an internal or external x87 FPU when set; 
indicates an x87 FPU is present when clear. This flag also affects the execution of 
MMX/SSE/SSE2/SSE3/SSSE3/SSE4 instructions. 


When the EM flag is set, execution of an x87 FPU instruction generates a device-not-available exception 
(#NM). This flag must be set when the processor does not have an internal x87 FPU or is not connected to 
an external math coprocessor. Setting this flag forces all floating-point instructions to be handled by soft- 
ware emulation. Table 10-3 shows the recommended setting of this flag, depending on the IA-32 processor 
and x87 FPU or math coprocessor present in the system. Table 2-2 shows the interaction of the EM, MP, and 
TS flags. 


Also, when the EM flag is set, execution of an MMX instruction causes an invalid-opcode exception (#UD) 
to be generated (see Table 13-1). Thus, if an IA-32 or Intel 64 processor incorporates MMX technology, the 
EM flag must be set to 0 to enable execution of MMX instructions. 


Similarly for SSE/SSE2/SSE3/SSSE3/SSE4 extensions, when the EM flag is set, execution of most 
SSE/SSE2/SSE3/SSSE3/SSE4 instructions causes an invalid opcode exception (#UD) to be generated (see 
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Table 14-1). If an IA-32 or Intel 64 processor incorporates the SSE/SSE2/SSE3/SSSE3/SSE4 extensions, 
the EM flag must be set to 0 to enable execution of these extensions. SSE/SSE2/SSE3/SSSE3/SSE4 
instructions not affected by the EM flag include: PAUSE, PREFETCHhA, SFENCE, LFENCE, MFENCE, MOVNTI, 
CLFLUSH, CRC32, and POPCNT. 


CRO.MP 
Monitor Coprocessor (bit 1 of CRO) — Controls the interaction of the WAIT (or FWAIT) instruction with 
the TS flag (bit 3 of CRO). If the MP flag is set, a WAIT instruction generates a device-not-available exception 
(#NM) if the TS flag is also set. If the MP flag is clear, the WAIT instruction ignores the setting of the TS flag. 
Table 10-3 shows the recommended setting of this flag, depending on the IA-32 processor and x87 FPU or 
math coprocessor present in the system. Table 2-2 shows the interaction of the MP, EM, and TS flags. 
CRO.PE 
Protection Enable (bit 0 of CRO) — Enables protected mode when set; enables real-address mode when 
clear. This flag does not enable paging directly. It only enables segment-level protection. To enable paging, 
both the PE and PG flags must be set. 
See also: Section 10.9, “Mode Switching.” 


CR3.PCD 
Page-level Cache Disable (bit 4 of CR3) — Controls the memory type used to access the first paging 
structure of the current paging-structure hierarchy. See Section 4.9, “Paging and Memory Typing.” This bit 
is not used if paging is disabled, with PAE paging, or with 4-level paging! or 5-level paging if CR4.PCIDE=1. 
CR3.PWT 
Page-level Write-Through (bit 3 of CR3) — Controls the memory type used to access the first paging 
structure of the current paging-structure hierarchy. See Section 4.9, “Paging and Memory Typing.” This bit 
is not used if paging is disabled, with PAE paging, or with 4-level paging or 5-level paging if CR4.PCIDE=1. 
CR4.VME 
Virtual-8086 Mode Extensions (bit 0 of CR4) — Enables interrupt- and exception-handling extensions 
in virtual-8086 mode when set; disables the extensions when clear. Use of the virtual mode extensions can 
improve the performance of virtual-8086 applications by eliminating the overhead of calling the virtual- 
8086 monitor to handle interrupts and exceptions that occur while executing an 8086 program and, 
instead, redirecting the interrupts and exceptions back to the 8086 program’s handlers. It also provides 
hardware support for a virtual interrupt flag (VIF) to improve reliability of running 8086 programs in multi- 
tasking and multiple-processor environments. 
See also: Section 21.3, “Interrupt and Exception Handling in Virtual-8086 Mode.” 


CR4.PVI 
Protected-Mode Virtual Interrupts (bit 1 of CR4) — Enables hardware support for a virtual interrupt 
flag (VIF) in protected mode when set; disables the VIF flag in protected mode when clear. 
See also: Section 21.4, “Protected-Mode Virtual Interrupts.” 


CR4.TSD 
Time Stamp Disable (bit 2 of CR4) — Restricts the execution of the RDTSC instruction to procedures 
running at privilege level 0 when set; allows RDTSC instruction to be executed at any privilege level when 
clear. This bit also applies to the RDTSCP instruction if supported (if CPUID.80000001H:EDX[27] = 1). 
CR4.DE 
Debugging Extensions (bit 3 of CR4) — References to debug registers DR4 and DR5 cause an unde- 
fined opcode (#UD) exception to be generated when set; when clear, processor aliases references to regis- 
ters DR4 and DRS for compatibility with software written to run on earlier IA-32 processors. 
See also: Section 18.2.2, ‘Debug Registers DR4 and DR5.” 


CR4.PSE 


Page Size Extensions (bit 4 of CR4) — Enables 4-MByte pages with 32-bit paging when set; restricts 
32-bit paging to pages of 4 KBytes when clear. 


See also: Section 4.3, “32-Bit Paging.” 


1. Earlier versions of this manual used the term “IA-32e paging” to identify 4-level paging. 
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CR4.PAE 
Physical Address Extension (bit 5 of CR4) — When set, enables paging to produce physical addresses 
with more than 32 bits. When clear, restricts physical addresses to 32 bits. PAE must be set before entering 
IA-32e mode. 


See also: Chapter 4, “Paging.” 


CR4.MCE 
Machine-Check Enable (bit 6 of CR4) — Enables the machine-check exception when set; disables the 
machine-check exception when clear. 


See also: Chapter 16, “Machine-Check Architecture.” 


CR4.PGE 
Page Global Enable (bit 7 of CR4) — (Introduced in the P6 family processors.) Enables the global page 
feature when set; disables the global page feature when clear. The global page feature allows frequently 
used or shared pages to be marked as global to all users (done with the global flag, bit 8, in a page-direc- 
tory-pointer-table entry, a page-directory entry, or a page-table entry). Global pages are not flushed from 
the translation-lookaside buffer (TLB) on a task switch or a write to register CR3. 


When enabling the global page feature, paging must be enabled (by setting the PG flag in control register 
CRO) before the PGE flag is set. Reversing this sequence may affect program correctness, and processor 
performance will be impacted. 


See also: Section 4.10, “Caching Translation Information.” 


CR4.PCE 
Performance-Monitoring Counter Enable (bit 8 of CR4) — Enables execution of the RDPMC instruc- 
tion for programs or procedures running at any protection level when set; RDPMC instruction can be 
executed only at protection level 0 when clear. 


CR4.0SFXSR 
Operating System Support for FXSAVE and FXRSTOR instructions (bit 9 of CR4) — When set, this 
flag: (1) indicates to software that the operating system supports the use of the FXSAVE and FXRSTOR 
instructions, (2) enables the FXSAVE and FXRSTOR instructions to save and restore the contents of the 
XMM and MXCSR registers along with the contents of the x87 FPU and MMX registers, and (3) enables the 
processor to execute SSE/SSE2/SSE3/SSSE3/SSE4 instructions, with the exception of the PAUSE, 
PREFETCHh, SFENCE, LFENCE, MFENCE, MOVNTI, CLFLUSH, CRC32, and POPCNT. 


If this flag is clear, the FXSAVE and FXRSTOR instructions will save and restore the contents of the x87 FPU 
and MMxX registers, but they may not save and restore the contents of the XMM and MXCSR registers. Also, 
the processor will generate an invalid opcode exception (#UD) if it attempts to execute any 
SSE/SSE2/SSE3 instruction, with the exception of PAUSE, PREFETCHh, SFENCE, LFENCE, MFENCE, 
MOVNTI, CLFLUSH, CRC32, and POPCNT. The operating system or executive must explicitly set this flag. 


NOTE 


CPUID feature flag FXSR indicates availability of the FKSAVE/FXRSTOR instructions. The OSFXSR 
bit provides operating system software with a means of enabling FXKSAVE/FXRSTOR to save/restore 
the contents of the X87 FPU, XMM, and MXCSR registers. Consequently OSFXSR bit indicates that 
the operating system provides context switch support for SSE/SSE2/SSE3/SSSE3/SSE4. 


CR4.0SXMMEXCPT 
Operating System Support for Unmasked SIMD Floating-Point Exceptions (bit 10 of CR4) — 
When set, indicates that the operating system supports the handling of unmasked SIMD floating-point 
exceptions through an exception handler that is invoked when a SIMD floating-point exception (#XM) is 
generated. SIMD floating-point exceptions are only generated by SSE/SSE2/SSE3/SSE4.1 SIMD floating- 
point instructions. 


The operating system or executive must explicitly set this flag. If this flag is not set, the processor will 
generate an invalid opcode exception (#UD) whenever it detects an unmasked SIMD floating-point excep- 
tion. 
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CR4.UMIP 
User-Mode Instruction Prevention (bit 11 of CR4) — When set, the following instructions cannot be 
executed if CPL > 0: SGDT, SIDT, SLDT, SMSW, and STR. An attempt at such execution causes a general- 
protection exception (#GP). 


CR4.LA57 
57-bit linear addresses (bit 12 of CR4) — When set in IA-32e mode, the processor uses 5-level paging 
to translate 57-bit linear addresses. When clear in IA-32e mode, the processor uses 4-level paging to 
translate 48-bit linear addresses. This bit cannot be modified in IA-32e mode. 


See also: Chapter 4, “Paging.” 


CR4.VMXE 
VMX-Enable Bit (bit 13 of CR4) — Enables VMX operation when set. See Chapter 24, “Introduction to 
Virtual Machine Extensions.” 


CR4.SMXE 
SMX-Enable Bit (bit 14 of CR4) — Enables SMX operation when set. See Chapter 7, “Safer Mode Exten- 
sions Reference,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D. 


CR4.FSGSBASE 
FSGSBASE-Enable Bit (bit 16 of CR4) — Enables the instructions RDFSBASE, RDGSBASE, WRFSBASE, 
and WRGSBASE. 


CR4.PCIDE 
PCID-Enable Bit (bit 17 of CR4) — Enables process-context identifiers (PCIDs) when set. See Section 
4.10.1, “Process-Context Identifiers (PCIDs).” Applies only in IA-32e mode (if IA32_EFER.LMA = 1). 


CR4.0SXSAVE 
XSAVE and Processor Extended States-Enable Bit (bit 18 of CR4) — When set, this flag: (1) indi- 
cates (via CPUID.01H:ECX.OSXSAVE[bit 27]) that the operating system supports the use of the XGETBV, 
XSAVE, and XRSTOR instructions by general software; (2) enables the XSAVE and XRSTOR instructions to 
save and restore the x87 FPU state (including MMX registers), the SSE state (XMM registers and MXCSR), 
along with other processor extended states enabled in XCRO; (3) enables the processor to execute XGETBV 
and XSETBV instructions in order to read and write XCRO. See Section 2.6 and Chapter 14, “System 
Programming for Instruction Set Extensions and Processor Extended States.” 


CR4.KL 
Key-Locker-Enable Bit (bit 19 of CR4) — When set, the LOADIWKEY instruction is enabled; in addition, 
if support for the AES Key Locker instructions has been activated by system firmware, 
CPUID.19H:EBX.AESKLE[bit 0] is enumerated as 1 and the AES Key Locker instructions are enabled. 
When clear, CPUID.19H:EBX.AESKLE[bit 0] is enumerated as 0 and execution of any Key Locker instruction 
causes an invalid-opcode exception (#UD). 


CR4.SMEP 
SMEP-Enable Bit (bit 20 of CR4) — Enables supervisor-mode execution prevention (SMEP) when set. 
See Section 4.6, “Access Rights.” 


CR4.SMAP 
SMAP-Enable Bit (bit 21 of CR4) — Enables supervisor-mode access prevention (SMAP) when set. See 
Section 4.6, “Access Rights.” 


CR4.PKE 
Enable protection keys for user-mode pages (bit 22 of CR4) — 4-level paging and 5-level paging 
associate each user-mode linear address with a protection key. When set, this flag indicates (via 
CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4]) that the operating system supports use of the PKRU 
register to specify, for each protection key, whether user-mode linear addresses with that protection key 
can be read or written. This bit also enables access to the PKRU register using the RDPKRU and WRPKRU 
instructions. 


1. Software can check CPUID.19H:EBX.AESKLE[bit 0] after setting CR4.KL to determine whether the AES Key Locker instructions have 
been enabled. Note that some processors may allow enabling of those instructions without activation by system firmware. Some 
processors may not support use of the AES Key Locker instructions in system-management mode (SMM). Those processors enumer- 
ate CPUID.19H:EBX.AESKLE[bit 0] as O in SMM regardless of the setting of CR4.KL. 
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CR4.CET 
Control-flow Enforcement Technology (bit 23 of CR4) — Enables control-flow enforcement tech- 
nology when set. See Chapter 17, “Control-flow Enforcement Technology (CET),” of the IA-32 Inte/® Archi- 
tecture Software Developer’s Manual, Volume 1. This flag can be set only if CRO.WP is set, and it must be 
clear before CRO.WP can be cleared (see below). 


CR4.PKS 
Enable protection keys for supervisor-mode pages (bit 24 of CR4) — 4-level paging and 5-level 
paging associate each supervisor-mode linear address with a protection key. When set, this flag allows use 
of the IA32_PKRS MSR to specify, for each protection key, whether supervisor-mode linear addresses with 
that protection key can be read or written. 


CR4.UINTR 
User Interrupts Enable Bit (bit 25 of CR4) — Enables user interrupts when set, including user-interrupt 
delivery, user-interrupt notification identification, and the user-interrupt instructions. 


CR8.TPL 
Task Priority Level (bit 3:0 of CR8) — This sets the threshold value corresponding to the highest- 
priority interrupt to be blocked. A value of 0 means all interrupts are enabled. This field is available in 64- 
bit mode. A value of 15 means all interrupts will be disabled. 


2.0.1 CPUID Qualification of Control Register Flags 


Not all flags in control register CR4 are implemented on all processors. With the exception of the PCE flag, they can 
be qualified with the CPUID instruction to determine if they are implemented on the processor before they are 
used. 


The CR8 register is available on processors that support Intel 64 architecture. 


2.6 EXTENDED CONTROL REGISTERS (INCLUDING XCRO) 


If CPUID.O1H:ECX.XSAVE[bit 26] is 1, the processor supports one or more extended control registers (XCRs). 
Currently, the only such register defined is XCRO. This register specifies the set of processor state components for 
which the operating system provides context management, e.g., x87 FPU state, SSE state, AVX state. The OS 
programs XCRO to reflect the features for which it provides context management. 
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63 18 17 10 9 8 7 6 5 4 3 2 1 #0 


Reserved for XCRO bit vector expansion 
Reserved / Future processor extended states 
TILEDATA state 
TILECONFIG state 
PKRU state 
Hi16_ZMM state 
ZMM_Hi256 state 
Opmask state 
BNDCSR state 
BNDREG state 
AVX state 
SSE state 
X87 FPU/MMxX state (must be 1) 


Reserved (must be 0) 


Figure 2-8. XCRO 


Software can access XCRO only if CR4.OSXSAVE[bit 18] = 1. (This bit is also readable as 
CPUID.01H:ECX.OSXSAVE[bit 27].) Software can use CPUID leaf function ODH to enumerate the bits in XCRO that 
the processor supports (see CPUID instruction in Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 2A). Each supported state component is represented by a bit in XCRO. System software enables state 
components by loading an appropriate bit mask value into XCRO using the XSETBV instruction. 


As each bit in XCRO (except bit 63) corresponds to a processor state component, XCRO thus provides support for 
up to 63 sets of processor state components. Bit 63 of XCRO is reserved for future expansion and will not represent 
a processor state component. 


Currently, XCRO defines support for the following state components: 


XCRO.X87 (bit 0): This bit 0 must be 1. An attempt to write 0 to this bit causes a #GP exception. 


XCRO.SSE (bit 1): If 1, the XSAVE feature set can be used to manage MXCSR and the XMM registers (XMMO- 
XMM15 in 64-bit mode; otherwise XMMO-XMM7). 


XCRO.AVX (bit 2): If 1, Intel AVX instructions can be executed and the XSAVE feature set can be used to 
manage the upper halves of the YMM registers (YMMO-YMM15 in 64-bit mode; otherwise YMMO-YMM7),. 


XCRO.BNDREG (bit 3): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to 
manage the bounds registers BNDO-BND3. 


XCRO.BNDCSR (bit 4): If 1, Intel MPX instructions can be executed and the XSAVE feature set can be used to 
manage the BNDCFGU and BNDSTATUS registers. 


XCRO.opmask (bit 5): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be used 
to manage the opmask registers kO-k7. 


XCRO.ZMM_Hi256 (bit 6): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be 
used to manage the upper halves of the lower ZMM registers (ZMMO-ZMM15 in 64-bit mode; otherwise ZMMO- 
ZMM7). 


XCRO.Hi16_ZMM (bit 7): If 1, Intel AVX-512 instructions can be executed and the XSAVE feature set can be 
used to manage the upper ZMM registers (ZMM16-ZMM31, only in 64-bit mode). 


XCRO.PKRU (bit 9): If 1, the XSAVE feature set can be used to manage the PKRU register (see Section 2.7). 


XCRO.TILECFG (bit 17): If 1, and if XCRO.TILEDATA is also 1, Intel AMX instructions can be executed and the 
XSAVE feature set can be used to manage TILECFG. 
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¢ XCRO.TILEDATA (bit 18): If 1, and if XCRO.TILECFG is also 1, Intel AMX instructions can be executed and the 
XSAVE feature set can be used to manage TILEDATA. 


An attempt to use XSETBV to write to XCRO results in general-protection exceptions (#GP) if it would do any of the 
following: 


° Set a bit reserved in XCRO for a given processor (as determined by the contents of EAX and EDX after executing 
CPUID with EAX=0DH, ECX= OH). 


°® Clear XCRO.x87. 

° Clear XCRO.SSE and set XCRO.AVX. 

°® Clear XCRO.AVX and set any of XCRO.opmask, XCRO.ZMM_Hi256, or XCRO.Hi16_ZMM. 

¢ Set either XCRO.BNDREG or XCRO.BNDCSR while not setting the other. 

° Set any of XCRO.opmask, XCRO.ZMM_Hi256, and XCRO.Hi16_ZMM while not setting all of them. 
¢ Set either XCRO.TILECFG or XCRO.TILEDATA while not setting the other. 

After reset, all bits (except bit 0) in XCRO are cleared to zero; XCRO[O] is set to 1. 


2.7 PROTECTION-KEY RIGHTS REGISTERS (PKRU AND IA32_PKRS) 


Processors may support either or both of two protection-key rights registers: PKRU for user-mode pages and the 
IA32_PKRS MSR (MSR index 6E1H) for supervisor-mode pages. 4-level paging and 5-level paging associate a 4-bit 
protection key with each page. The protection-key rights registers determine accessibility based on a page’s 
protection key. 


If CPUID.(EAX=07H,ECX=0H):ECX.PKU [bit 3] = 1, the processor supports the protection-key feature for user- 
mode pages. When CR4.PKE = 1, software can use the protection-key rights register for user pages (PKRU) 
to specify the access rights for user-mode pages for each protection key. 


If CPUID.(EAX=07H,ECX=0H):ECX.PKS [bit 31] = 1, the processor supports the protection-key feature for super- 
visor-mode pages. When CR4.PKS = 1, software can use the protection-key rights register for supervisor 
Pages (the IA32_PKRS MSR) to specify the access rights for supervisor-mode pages for each protection key. 
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Figure 2-9. Format of Protection-Key Rights Registers 


The format of each protection-key rights register is given in Figure 2-9. Each contains 16 pairs of disable controls 
to prevent data accesses to linear addresses (user-mode or supervisor-mode, depending on the register) based on 
their protection keys. Each protection key / (0 </ < 15) is associated with two bits in each protection-key rights 
register: 


° Bit 2/, shown as “ADi” (access disable): if set, the processor prevents any data accesses to linear addresses 
(user-mode or supervisor-mode, depending on the register) with protection key i. 


° Bit 2i+1, shown as “WDi” (write disable): if set, the processor prevents write accesses to linear addresses 
(user-mode or supervisor-mode, depending on the register) with protection key i. 


(Bits 63:32 of the IA32_PKRS MSR are reserved and must be zero.) 


See Section 4.6.2, “Protection Keys,” for details of how the processor uses the protection-key rights registers to 
control accesses to linear addresses. 


Software can read and write PKRU using the RDPKRU and WRPKRU instructions. The IA32_PKRS MSR can be read 
and written with the RDMSR and WRMSR instructions. Writes to the IA32_PKRS MSR using WRMSR are not serial- 
izing. 
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2.8 SYSTEM INSTRUCTION SUMMARY 


System instructions handle system-level functions such as loading system registers, managing the cache, 
managing interrupts, or setting up the debug registers. Many of these instructions can be executed only by oper- 
ating-system or executive procedures (that is, procedures running at privilege level 0). Others can be executed at 
any privilege level and are thus available to application programs. 


Table 2-3 lists the system instructions and indicates whether they are available and useful for application 
programs. These instructions are described in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volumes 2A, 2B, 2C, & 2D. 


Table 2-3. Summary of System Instructions 


Useful to Protected from 
Instruction Description Application? Application? 
LLDT Load LDT Register No Yes 
SLDT Store LDT Register No If CR4.UMIP = 1 
LGDT Load GDT Register No Yes 
SGDT Store GDT Register No If CR4.UMIP = 1 
LTR Load Task Register No Yes 
STR Store Task Register No If CR4.UMIP = 1 
LIDT Load IDT Register No Yes 
SIDT Store IDT Register No If CR4.UMIP = 1 
MOV CRn Load and store control registers No Yes 
SMSW Store MSW Yes If CR4.UMIP = 1 
LMSW Load MSW No Yes 
CLTS Clear TS flag in CRO No Yes 
ARPL Adjust RPL Yes". No 
LAR Load Access Rights Yes No 
LSL Load Segment Limit Yes No 
VERR Verify for Reading Yes No 
VERW Verify for Writing Yes No 
MOV DRn Load and store debug registers No Yes 
INVD Invalidate cache, no writeback No Yes 
WBINVD Invalidate cache, with writeback No Yes 
INVLPG Invalidate TLB entry No Yes 
HLT Halt Processor No Yes 
LOCK (Prefix) Bus Lock Yes No 
RSM Return from system management mode No Yes 
RDMSR2 Read Model-Specific Registers No Yes 
WRMSR3 Write Model-Specific Registers No Yes 
RDPMC* Read Performance-Monitoring Counter Yes Yes? 
RDTSC3 Read Time-Stamp Counter Yes Yes2 
RDTSCP?” Read Serialized Time-Stamp Counter Yes Yes? 
XGETBV Return the state of XCRO Yes No 
XSETBV Enable one or more processor extended states No® Yes 
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Table 2-3. Summary of System Instructions (Contd.) 


Useful to Protected from 
Instruction Description Application? Application? 


NOTES: 

1. Useful to application programs running at a CPL of 1 or 2. 

2. The TSD and PCE flags in control register CR4 control access to these instructions by application programs running at a CPL of 3. 

3. These instructions were introduced into the IA-32 Architecture with the Pentium processor. 

4. This instruction was introduced into the IA-32 Architecture with the Pentium Pro processor and the Pentium processor with MMX technol- 
ogy. 

. This instruction is not supported in 64-bit mode. 

. Application uses XGETBV to query which set of processor extended states are enabled. 

7. RDTSCP is introduced in Intel Core i7 processor. 


nu 


2.8.1 Loading and Storing System Registers 


The GDTR, LDTR, IDTR, and TR registers each have a load and store instruction for loading data into and storing 
data from the register: 


¢ LGDT (Load GDTR Register) — Loads the GDT base address and limit from memory into the GDTR register. 
° SGDT (Store GDTR Register) — Stores the GDT base address and limit from the GDTR register into memory. 
¢ LIDT (Load IDTR Register) — Loads the IDT base address and limit from memory into the IDTR register. 

¢ SIDT (Store IDTR Register) — Stores the IDT base address and limit from the IDTR register into memory. 


¢ LLDT (Load LDTR Register) — Loads the LDT segment selector and segment descriptor from memory into 
the LDTR. (The segment selector operand can also be located in a general-purpose register. ) 


* SLDT (Store LDTR Register) — Stores the LDT segment selector from the LDTR register into memory or a 
general-purpose register. 


¢ LTR (Load Task Register) — Loads segment selector and segment descriptor for a TSS from memory into the 
task register. (The segment selector operand can also be located in a general-purpose register. ) 


¢ STR (Store Task Register) — Stores the segment selector for the current task TSS from the task register into 
memory or a general-purpose register. 


The LMSW (load machine status word) and SMSW (store machine status word) instructions operate on bits 0 
through 15 of control register CRO. These instructions are provided for compatibility with the 16-bit Intel 286 
processor. Programs written to run on 32-bit IA-32 processors should not use these instructions. Instead, they 
should access the control register CRO using the MOV CR instruction. 


The CLTS (clear TS flag in CRO) instruction is provided for use in handling a device-not-available exception (#NM) 
that occurs when the processor attempts to execute a floating-point instruction when the TS flag is set. This 
instruction allows the TS flag to be cleared after the x87 FPU context has been saved, preventing further #NM 
exceptions. See Section 2.5, “Control Registers,” for more information on the TS flag. 


The control registers (CRO, CR1, CR2, CR3, CR4, and CR8) are loaded using the MOV instruction. The instruction 
loads a control register from a general-purpose register or stores the content of a control register in a general- 
purpose register. 


2.8.2 Verifying of Access Privileges 


The processor provides several instructions for examining segment selectors and segment descriptors to determine 
if access to their associated segments is allowed. These instructions duplicate some of the automatic access rights 
and type checking done by the processor, thus allowing operating-system or executive software to prevent excep- 
tions from being generated. 


The ARPL (adjust RPL) instruction adjusts the RPL (requestor privilege level) of a segment selector to match that of 
the program or procedure that supplied the segment selector. See Section 5.10.4, “Checking Caller Access Privi- 
leges (ARPL Instruction),” for a detailed explanation of the function and use of this instruction. Note that ARPL is 
not supported in 64-bit mode. 
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The LAR (load access rights) instruction verifies the accessibility of a specified segment and loads access rights 
information from the segment’s segment descriptor into a general-purpose register. Software can then examine 
the access rights to determine if the segment type is compatible with its intended use. See Section 5.10.1, 
“Checking Access Rights (LAR Instruction),” for a detailed explanation of the function and use of this instruction. 


The LSL (load segment limit) instruction verifies the accessibility of a specified segment and loads the segment 
limit from the segment’s segment descriptor into a general-purpose register. Software can then compare the 
segment limit with an offset into the segment to determine whether the offset lies within the segment. See Section 
5.10.3, “Checking That the Pointer Offset Is Within Limits (LSL Instruction),” for a detailed explanation of the func- 
tion and use of this instruction. 


The VERR (verify for reading) and VERW (verify for writing) instructions verify if a selected segment is readable or 
writable, respectively, at a given CPL. See Section 5.10.2, “Checking Read/Write Rights (VERR and VERW Instruc- 
tions),” for a detailed explanation of the function and use of these instructions. 


2.8.3 Loading and Storing Debug Registers 


Internal debugging facilities in the processor are controlled by a set of 8 debug registers (DRO-DR7). The MOV 
instruction allows setup data to be loaded to and stored from these registers. 


On processors that support Intel 64 architecture, debug registers DRO-DR7 are 64 bits. In 32-bit modes and 
compatibility mode, writes to a debug register fill the upper 32 bits with zeros. Reads return the lower 32 bits. In 
64-bit mode, the upper 32 bits of DR6-DR7 are reserved and must be written with zeros. Writing one to any of the 
upper 32 bits causes an exception, #GP(0). 


In 64-bit mode, MOV DRn instructions read or write all 64 bits of a debug register (operand-size prefixes are 
ignored). All 64 bits of DRO-DR3 are writable by software. However, MOV DRn instructions do not check that 
addresses written to DRO-DR3 are in the limits of the implementation. Address matching is supported only on valid 
addresses generated by the processor implementation. 


2.8.4 Invalidating Caches and TLBs 


The processor provides several instructions for use in explicitly invalidating its caches and TLB entries. The INVD 
(invalidate cache with no writeback) instruction invalidates all data and instruction entries in the internal caches 
and sends a signal to the external caches indicating that they should also be invalidated. 


The WBINVD (invalidate cache with writeback) instruction performs the same function as the INVD instruction, 
except that it writes back modified lines in its internal caches to memory before it invalidates the caches. After 
invalidating the caches local to the executing logical processor or processor core, WBINVD signals caches higher in 
the cache hierarchy (caches shared with the invalidating logical processor or core) to write back any data they have 
in modified state at the time of instruction execution and to invalidate their contents. 


Note, non-shared caches may not be written back nor invalidated. In Figure 2-10 below, if code executing on either 
LPO or LP1 were to execute a WBINVD, the shared L1 and L2 for LPO/LP1 will be written back and invalidated as will 
the shared L3. However, the L1 and L2 caches not shared with LPO and LP1 will not be written back nor invalidated. 
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Figure 2-10. WBINVD Invalidation of Shared and Non-Shared Cache Hierarchy 
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The INVLPG (invalidate TLB entry) instruction invalidates (flushes) the TLB entry for a specified page. 


2.8.5 Controlling the Processor 


The HLT (halt processor) instruction stops the processor until an enabled interrupt (such as NMI or SMI, which are 
normally enabled), a debug exception, the BINIT# signal, the INIT# signal, or the RESET# signal is received. The 
processor generates a special bus cycle to indicate that the halt mode has been entered. 


Hardware may respond to this signal in a number of ways. An indicator light on the front panel may be turned on. 
An NMI interrupt for recording diagnostic information may be generated. Reset initialization may be invoked (note 
that the BINIT# pin was introduced with the Pentium Pro processor). If any non-wake events are pending during 

shutdown, they will be handled after the wake event from shutdown is processed (for example, A20M# interrupts). 


The LOCK prefix invokes a locked (atomic) read-modify-write operation when modifying a memory operand. This 
mechanism is used to allow reliable communications between processors in multiprocessor systems, as described 
below: 


¢ In the Pentium processor and earlier IA-32 processors, the LOCK prefix causes the processor to assert the 
LOCK# signal during the instruction. This always causes an explicit bus lock to occur. 


¢ Inthe Pentium 4, Intel Xeon, and P6 family processors, the locking operation is handled with either a cache lock 
or bus lock. If a memory access is cacheable and affects only a single cache line, a cache lock is invoked and 
the system bus and the actual memory location in system memory are not locked during the operation. Here, 
other Pentium 4, Intel Xeon, or P6 family processors on the bus write-back any modified data and invalidate 
their caches as necessary to maintain system memory coherency. If the memory access is not cacheable 
and/or it crosses a cache line boundary, the processor’s LOCK# signal is asserted and the processor does not 
respond to requests for bus control during the locked operation. 


The RSM (return from SMM) instruction restores the processor (from a context dump) to the state it was in prior to 
a system management mode (SMM) interrupt. 


2.8.6 Reading Performance-Monitoring and Time-Stamp Counters 


The RDPMC (read performance-monitoring counter) and RDTSC (read time-stamp counter) instructions allow 
application programs to read the processor’s performance-monitoring and time-stamp counters, respectively. 
Processors based on Intel NetBurst® microarchitecture have eighteen 40-bit performance-monitoring counters; P6 
family processors have two 40-bit counters. Intel Atom® processors and most of the processors based on the Intel 
Core microarchitecture support two types of performance monitoring counters: programmable performance coun- 
ters similar to those available in the P6 family, and three fixed-function performance monitoring counters. Details 
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of programmable and fixed-function performance monitoring counters for each processor generation are described 
in Chapter 20, “Performance Monitoring.” 


The programmable performance counters can support counting either the occurrence or duration of events. Events 
that can be monitored on programmable counters generally are model specific (except for architectural perfor- 
mance events enumerated by CPUID leaf OAH); they may include the number of instructions decoded, interrupts 
received, or the number of cache loads. Individual counters can be set up to monitor different events. Use the 
system instruction WRMSR to set up values in one of the IA32_ PERFEVTSELx MSR, in one of the 45 ESCRs and one 
of the 18 CCCR MSRs (for Pentium 4 and Intel Xeon processors); or in the PerfEvtSelO or the PerfEvtSel1 MSR (for 
the P6 family processors). The RDPMC instruction loads the current count from the selected counter into the 
EDX:EAX registers. 


Fixed-function performance counters record only specific events that are defined at: https://perfmon- 
events.intel.com/, and the width/number of fixed-function counters are enumerated by CPUID leaf OAH. 


The time-stamp counter is a model-specific 64-bit counter that is reset to zero each time the processor is reset. If 
not reset, the counter will increment ~9.5 x 10!° times per year when the processor is operating at a clock rate 
of 3GHz. At this clock frequency, it would take over 190 years for the counter to wrap around. The RDTSC 
instruction loads the current count of the time-stamp counter into the EDX:EAX registers. 


See Section 20.1, “Performance Monitoring Overview,” and Section 18.17, “Time-Stamp Counter,” for more infor- 
mation about the performance monitoring and time-stamp counters. 


The RDTSC instruction was introduced into the IA-32 architecture with the Pentium processor. The RDPMC instruc- 
tion was introduced into the IA-32 architecture with the Pentium Pro processor and the Pentium processor with 
MMX technology. Earlier Pentium processors have two performance-monitoring counters, but they can be read only 
with the RDMSR instruction, and only at privilege level 0. 


2.8.6.1 Reading Counters in 64-Bit Mode 


In 64-bit mode, RDTSC operates the same as in protected mode. The count in the time-stamp counter is stored in 
EDX:EAX (or RDX[31:0]:RAX[31:0] with RDX[63:32]:RAX[63:32] cleared). 


RDPMC requires an index to specify the offset of the performance-monitoring counter. In 64-bit mode for Pentium 
4 or Intel Xeon processor families, the index is specified in ECX[30:0]. The current count of the performance-moni- 
toring counter is stored in EDX:EAX (or RDX[31:0]:RAX[31:0] with RDX[63:32]:RAX[63:32] cleared). 


2.8.7 Reading and Writing Model-Specific Registers 


The RDMSR (read model-specific register) and WRMSR (write model-specific register) instructions allow a 
processor’s 64-bit model-specific registers (MSRs) to be read and written, respectively. The MSR to be read or 
written is specified by the value in the ECX register. 


RDMSR reads the value from the specified MSR to the EDX:EAX registers; WRMSR writes the value in the EDX: EAX 
registers to the specified MSR. RDMSR and WRMSR were introduced into the IA-32 architecture with the Pentium 
processor. 


See Section 10.4, “Model-Specific Registers (MSRs),” for more information. 


2.8.7.1 Reading and Writing Model-Specific Registers in 64-Bit Mode 


RDMSR and WRMSR require an index to specify the address of an MSR. In 64-bit mode, the index is 32 bits; it is 
specified using ECX. 


2.8.8 Enabling Processor Extended States 


The XSETBV instruction is required to enable OS support of individual processor extended states in XCRO (see 
Section 2.6). 
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10.Updates to Chapter 9, Volume 3A 


Change bars and violet text show changes to Chapter 9 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A: System Programming Guide, Part 1. 


Changes to this chapter: 


e Added a statement to Section 9.1.2.3, “Features to Disable Bus Locks,” to indicate processor behavior when 
both bus lock features are enabled. 
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CHAPTER 9 
MULTIPLE-PROCESSOR MANAGEMENT 


The Intel 64 and IA-32 architectures provide mechanisms for managing and improving the performance of multiple 
processors connected to the same system bus. These include: 


* Bus locking and/or cache coherency management for performing atomic operations on system memory. 
®  Serializing instructions. 


¢ An advance programmable interrupt controller (APIC) located on the processor chip (see Chapter 11, 
“Advanced Programmable Interrupt Controller (APIC)”). This feature was introduced by the Pentium processor. 


¢ A second-level cache (level 2, L2). For the Pentium 4, Intel Xeon, and P6 family processors, the L2 cache is 
included in the processor package and is tightly coupled to the processor. For the Pentium and Intel486 
processors, pins are provided to support an external L2 cache. 


¢ A third-level cache (level 3, L3). For Intel Xeon processors, the L3 cache is included in the processor package 
and is tightly coupled to the processor. 


¢ Intel Hyper-Threading Technology. This extension to the Intel 64 and IA-32 architectures enables a single 
processor core to execute two or more threads concurrently (see Section 9.5, “Intel® Hyper-Threading 
Technology and Intel® Multi-Core Technology”). 


These mechanisms are particularly useful in symmetric-multiprocessing (SMP) systems. However, they can also be 
used when an Intel 64 or IA-32 processor and a special-purpose processor (such as a communications, graphics, 
or video processor) share the system bus. 


These multiprocessing mechanisms have the following characteristics: 


* To maintain system memory coherency — When two or more processors are attempting simultaneously to 
access the same address in system memory, some communication mechanism or memory access protocol 
must be available to promote data coherency and, in some instances, to allow one processor to temporarily lock 
a memory location. 

* To maintain cache consistency — When one processor accesses data cached on another processor, it must not 


receive incorrect data. If it modifies data, all other processors that access that data must receive the modified 
data. 


* To allow predictable ordering of writes to memory — In some circumstances, it is important that memory writes 
be observed externally in precisely the same order as programmed. 


°® To distribute interrupt handling among a group of processors — When several processors are operating ina 
system in parallel, it is useful to have a centralized mechanism for receiving interrupts and distributing them to 
available processors for servicing. 

° To increase system performance by exploiting the multi-threaded and multi-process nature of contemporary 
operating systems and applications. 

The caching mechanism and cache consistency of Intel 64 and IA-32 processors are discussed in Chapter 12. The 

APIC architecture is described in Chapter 11. Bus and memory locking, serializing instructions, memory ordering, 

and Intel Hyper-Threading Technology are discussed in the following sections. 


9.1 LOCKED ATOMIC OPERATIONS 


The 32-bit IA-32 processors support locked atomic operations on locations in system memory. These operations 
are typically used to manage shared data structures (such as semaphores, segment descriptors, system segments, 
or page tables) in which two or more processors may try simultaneously to modify the same field or flag. The 
processor uses three interdependent mechanisms for carrying out locked atomic operations: 


* Guaranteed atomic operations. 
* Bus locking, using the LOCK# signal and the LOCK instruction prefix. 
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® Cache coherency protocols that ensure that atomic operations can be carried out on cached data structures 
(cache lock); this mechanism is present in the Pentium 4, Intel Xeon, and P6 family processors. 


These mechanisms are interdependent in the following ways. Certain basic memory transactions (such as reading 
or writing a byte in system memory) are always guaranteed to be handled atomically. That is, once started, the 
processor guarantees that the operation will be completed before another processor or bus agent is allowed access 
to the memory location. The processor also supports bus locking for performing selected memory operations (such 
as a read-modify-write operation in a shared area of memory) that typically need to be handled atomically, but are 
not automatically handled this way. Because frequently used memory locations are often cached in a processor’s L1 
or L2 caches, atomic operations can often be carried out inside a processor’s caches without asserting the bus lock. 
Here the processor’s cache coherency protocols ensure that other processors that are caching the same memory 
locations are managed properly while atomic operations are performed on cached memory locations. 


NOTE 


Where there are contested lock accesses, software may need to implement algorithms that ensure 
fair access to resources in order to prevent lock starvation. The hardware provides no resource that 
guarantees fairness to participating agents. It is the responsibility of software to manage the 
fairness of semaphores and exclusive locking functions. 


The mechanisms for handling locked atomic operations have evolved with the complexity of IA-32 processors. More 
recent IA-32 processors (such as the Pentium 4, Intel Xeon, and P6 family processors) and Intel 64 provide a more 
refined locking mechanism than earlier processors. These mechanisms are described in the following sections. 


9.1.1 Guaranteed Atomic Operations 

The Intel486 processor (and newer processors since) guarantees that the following basic memory operations will 
always be carried out atomically: 

°¢ Reading or writing a byte. 

¢ Reading or writing a word aligned on a 16-bit boundary. 

¢ Reading or writing a doubleword aligned on a 32-bit boundary. 


The Pentium processor (and newer processors since) guarantees that the following additional memory operations 
will always be carried out atomically: 


® Reading or writing a quadword aligned on a 64-bit boundary. 
° 16-bit accesses to uncached memory locations that fit within a 32-bit data bus. 


The P6 family processors (and newer processors since) guarantee that the following additional memory operation 
will always be carried out atomically: 


® Unaligned 16-, 32-, and 64-bit accesses to cached memory that fit within a cache line. 

Processors that enumerate support for Intel® AVX (by setting the feature flag CPUID.01H:ECX.AVX[bit 28]) guar- 

antee that the 16-byte memory operations performed by the following instructions will always be carried out atom- 

ically: 

* MOVAPD, MOVAPS, and MOVDQA. 

¢ VMOVAPD, VMOVAPS, and VMOVDQA when encoded with VEX.128. 

¢ VMOVAPD, VMOVAPS, VMOVDQA32, and VMOVDQA64 when encoded with EVEX.128 and k0O (masking 
disabled). 

(Note that these instructions require the linear addresses of their memory operands to be 16-byte aligned.) 

Accesses to cacheable memory that are split across cache lines and page boundaries are not guaranteed to be 

atomic by the Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium M, Pentium 4, Intel Xeon, P6 family, Pentium, 

and Intel486 processors. The Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium M, Pentium 4, Intel Xeon, and 

P6 family processors provide bus control signals that permit external memory subsystems to make split accesses 


atomic; however, nonaligned data accesses will seriously impact the performance of the processor and should be 
avoided. 
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Except as noted above, an x87 instruction or an SSE instruction that accesses data larger than a quadword may be 
implemented using multiple memory accesses. If such an instruction stores to memory, some of the accesses may 
complete (writing to memory) while another causes the operation to fault for architectural reasons (e.g., due an 
page-table entry that is marked “not present”). In this case, the effects of the completed accesses may be visible 
to software even though the overall instruction caused a fault. If TLB invalidation has been delayed (see Section 
4.10.4.4), such page faults may occur even if all accesses are to the same page. 


9.1.2 Bus Locking 


Intel 64 and IA-32 processors provide a LOCK# signal that is asserted automatically during certain critical memory 
operations to lock the system bus or equivalent link. Assertion of this signal is called a bus lock. While this output 
signal is asserted, requests from other processors or bus agents for control of the bus are blocked. Software can 
specify other occasions when the LOCK semantics are to be followed by prepending the LOCK prefix to an instruc- 
tion. 


In the case of the Intel386, Intel486, and Pentium processors, explicitly locked instructions will result in the asser- 
tion of the LOCK# signal. It is the responsibility of the hardware designer to make the LOCK# signal available in 
system hardware to control memory accesses among processors. 


For the P6 and more recent processor families, if the memory area being accessed is cached internally in the 
processor, the LOCK# signal is generally not asserted; instead, locking is only applied to the processor’s caches 
(see Section 9.1.4, “Effects of a LOCK Operation on Internal Processor Caches”). These processors will assert a bus 
lock for a locked access in either of the following situations: (1) the access is to multiple cache lines (a split lock); 
or (2) the access uses a memory type other than WB (a UC lock)!. 


9.1.2.1 Automatic Locking 
The operations on which the processor automatically follows the LOCK semantics are as follows: 
¢ When executing an XCHG instruction that references memory. 


¢ When switching to a task, the processor tests and sets the busy flag in the type field of the TSS descriptor. To 
ensure that two processors do not switch to the same task simultaneously, the processor follows the LOCK 
semantics while testing and setting this flag. 


¢ When loading a segment descriptor, the processor sets the accessed flag in the segment descriptor if the flag is 
clear. During this operation, the processor follows the LOCK semantics so that the descriptor will not be 
modified by another processor while it is being updated. For this action to be effective, operating-system 
procedures that update descriptors should use the following steps: 


— Usea locked operation to modify the access-rights byte to indicate that the segment descriptor is not- 
present, and specify a value for the type field that indicates that the descriptor is being updated. 


— Update the fields of the segment descriptor. (This operation may require several memory accesses; 
therefore, locked operations cannot be used.) 


— Use a locked operation to modify the access-rights byte to indicate that the segment descriptor is valid and 
present. 


— The Intel386 processor always updates the accessed flag in the segment descriptor, whether it is clear or 
not. The Pentium 4, Intel Xeon, P6 family, Pentium, and Intel486 processors only update this flag if it is not 
already set. 


¢ The processor uses locked cycles to set the accessed and dirty flag in paging-structure entries. 


e = 6After an interrupt request, an interrupt controller may use the data bus to send the interrupt’s vector to the 
processor. The processor follows the LOCK semantics during this time to ensure that no other data appears on 
the data bus while the vector is being transmitted. 


1. The term “UC lock” is used because the most common situation regards accesses to UC memory. Despite the name, locked accesses 
to WC, WP, and WT memory also cause bus locks. 


Vol. 3A 9-3 


MULTIPLE-PROCESSOR MANAGEMENT 


9.1.2.2 Software Controlled Bus Locking 


To explicitly force the LOCK semantics, software can use the LOCK prefix with the following instructions when they 
are used to modify a memory location. An invalid-opcode exception (#UD) is generated when the LOCK prefix is 
used with any other instruction or when no write operation is made to memory (that is, when the destination 
operand is in a register). 


°¢ The bit test and modify instructions (BTS, BTR, and BTC). 

¢ The exchange instructions (XADD, CMPXCHG, CMPXCHG8B, and CMPXCHG16B). 

° The LOCK prefix is automatically assumed for XCHG instruction. 

¢ The following single-operand arithmetic and logical instructions: INC, DEC, NOT, and NEG. 

¢ The following two-operand arithmetic and logical instructions: ADD, ADC, SUB, SBB, AND, OR, and XOR. 


A locked instruction is guaranteed to lock only the area of memory defined by the destination operand, but may be 
interpreted by the system as a lock for a larger memory area. 


Software should access semaphores (shared memory used for signalling between multiple processors) using iden- 
tical addresses and operand lengths. For example, if one processor accesses a semaphore using a word access, 
other processors should not access the semaphore using a byte access. 


NOTE 


Do not implement semaphores using the WC memory type. Do not perform non-temporal stores to 
a cache line containing a location used to implement a semaphore. 


The integrity of a bus lock is not affected by the alignment of the memory field. The LOCK semantics are followed 
for as many bus cycles as necessary to update the entire operand. However, it is recommend that locked accesses 
be aligned on their natural boundaries for better system performance: 


e Any boundary for an 8-bit access (locked or otherwise). 
® 16-bit boundary for locked word accesses. 

¢* 32-bit boundary for locked doubleword accesses. 

° 64-bit boundary for locked quadword accesses. 


Locked operations are atomic with respect to all other memory operations and all externally visible events. Only 
instruction fetch and page table accesses can pass locked instructions. Locked instructions can be used to synchro- 
nize data written by one processor and read by another processor. 


For the P6 family processors, locked operations serialize all outstanding load and store operations (that is, wait for 
them to complete). This rule is also true for the Pentium 4 and Intel Xeon processors, with one exception. Load 
operations that reference weakly ordered memory types (such as the WC memory type) may not be serialized. 


Locked instructions should not be used to ensure that data written can be fetched as instructions. 


NOTE 


The locked instructions for the current versions of the Pentium 4, Intel Xeon, P6 family, Pentium, 
and Intel486 processors allow data written to be fetched as instructions. However, Intel 
recommends that developers who require the use of self-modifying code use a different synchro- 
nizing mechanism, described in the following sections. 


9.1.2.3 Features to Disable Bus Locks 


Because bus locks may adversely affect performance in certain situations, processors may support two features 
that system software can use to disable bus locking. These are called UC-lock disable and split-lock disable. 


A processor enumerates support for UC-lock disable by setting bit 4 of the IA32_CORE_CAPABILITIES MSR (MSR 
index CFH). Support for split-lock disable is enumerated by IA32_CORE_CAPABILITIES[5]. 


Software enables UC-lock disable by setting bit 28 of the MSR_MEMORY_CTRL MSR (MSR index 33H). When this bit 
is set, a locked access using a memory type other than WB causes a general-protection exception (#GP) witha 
zero error code. The locked access does not occur. 
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Software enables split-lock disable by setting MSR_MEMORY_CTRL[29]. When this bit is set, a locked access to 
multiple cache lines causes an alignment-check exception (#AC) with a zero error code.! The locked access does 
not occur. 


If both features are enabled, a locked access to multiple cache lines causes #AC(0) regardless of the memory 
type(s) being accessed. 


While MSR_MEMORY_CTRL is not an architectural MSR, the behavior described above is consistent across 
processor models that enumerate the support in IA32_CORE_CAPABILITIES. 


In addition to these features that disable bus locks, there are features that allow software to detect when a bus lock 
has occurred. See Section 18.3.1.6 for information about OS bus-lock detection and Section 26.2 for information 
about the VMM bus-lock detection. 


9.1.3 Handling Self- and Cross-Modifying Code 


The act of a processor writing data into a currently executing code segment with the intent of executing that data 
as code is called self-modifying code. IA-32 processors exhibit model-specific behavior when executing self- 
modified code, depending upon how far ahead of the current execution pointer the code has been modified. 


As processor microarchitectures become more complex and start to speculatively execute code ahead of the retire- 
ment point (as in P6 and more recent processor families), the rules regarding which code should execute, pre- or 
post-modification, become blurred. To write self-modifying code and ensure that it is compliant with current and 
future versions of the IA-32 architectures, use one of the following coding options: 


(* OPTION 1 *) 

Store modified code (as data) into code segment; 
Jump to new code or an intermediate location; 
Execute new code; 


(* OPTION 2 *) 

Store modified code (as data) into code segment; 

Execute a serializing instruction; (* For example, CPUID instruction *) 
Execute new code; 


The use of one of these options is not required for programs intended to run on the Pentium or Intel486 processors, 
but are recommended to ensure compatibility with the P6 and more recent processor families. 


Self-modifying code will execute at a lower level of performance than non-self-modifying or normal code. The 
degree of the performance deterioration will depend upon the frequency of modification and specific characteristics 
of the code. 


The act of one processor writing data into the currently executing code segment of a second processor with the 
intent of having the second processor execute that data as code is called cross-modifying code. As with self- 
modifying code, IA-32 processors exhibit model-specific behavior when executing cross-modifying code, 
depending upon how far ahead of the executing processors current execution pointer the code has been modified. 


To write cross-modifying code and ensure that it is compliant with current and future versions of the IA-32 archi- 
tecture, the following processor synchronization algorithm must be implemented: 


(* Action of Modifying Processor *) 

Memory_Flag := 0; (* Set Memory_Flag to value other than 1 *) 
Store modified code (as data) into code segment; 
Memory_Flag := 1; 


(* Action of Executing Processor *) 
WHILE (Memory_Flag # 1) 
Wait for code to update; 


1. Other alignment-check exceptions occur only if CRO.AM = 1, EFLAGS.AC = 1, and CPL = 3. The alignment-check exceptions resulting 
from split-lock disable may occur even if CRO.AM = 0, EFLAGS.AC = 0, or CPL < 3. 
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ELIHW; 
Execute serializing instruction; (* For example, CPUID instruction *) 
Begin executing modified code; 


(The use of this option is not required for programs intended to run on the Intel486 processor, but is recommended 
to ensure compatibility with the Pentium 4, Intel Xeon, P6 family, and Pentium processors. ) 


Like self-modifying code, cross-modifying code will execute at a lower level of performance than non-cross-modi- 
fying (normal) code, depending upon the frequency of modification and specific characteristics of the code. 


The restrictions on self-modifying code and cross-modifying code also apply to the Intel 64 architecture. 


9.1.4 Effects of a LOCK Operation on Internal Processor Caches 


For the Intel486 and Pentium processors, the LOCK# signal is always asserted on the bus during a LOCK operation, 
even if the area of memory being locked is cached in the processor. 


For the P6 and more recent processor families, if the area of memory being locked during a LOCK operation is 
cached in the processor that is performing the LOCK operation as write-back memory and is completely contained 
in a cache line, the processor may not assert the LOCK# signal on the bus. Instead, it will modify the memory loca- 
tion internally and allow it’s cache coherency mechanism to ensure that the operation is carried out atomically. This 
operation is called “cache locking.” The cache coherency mechanism automatically prevents two or more proces- 
sors that have cached the same area of memory from simultaneously modifying data in that area. 


9.2 MEMORY ORDERING 


The term memory ordering refers to the order in which the processor issues reads (loads) and writes (stores) 
through the system bus to system memory. The Intel 64 and IA-32 architectures support several memory-ordering 
models depending on the implementation of the architecture. For example, the Intel386 processor enforces 
program ordering (generally referred to as strong ordering), where reads and writes are issued on the system 
bus in the order they occur in the instruction stream under all circumstances. 


To allow performance optimization of instruction execution, the IA-32 architecture allows departures from strong- 
ordering model called processor ordering in Pentium 4, Intel Xeon, and P6 family processors. These processor- 
ordering variations (called here the memory-ordering model) allow performance enhancing operations such as 
allowing reads to go ahead of buffered writes. The goal of any of these variations is to increase instruction execu- 
tion speeds, while maintaining memory coherency, even in multiple-processor systems. 


Section 9.2.1 and Section 9.2.2 describe the memory-ordering implemented by Intel486, Pentium, Intel Core 2 
Duo, Intel Atom, Intel Core Duo, Pentium 4, Intel Xeon, and P6 family processors. Section 9.2.3 gives examples 
illustrating the behavior of the memory-ordering model on IA-32 and Intel-64 processors. Section 9.2.4 considers 
the special treatment of stores for string operations and Section 9.2.5 discusses how memory-ordering behavior 
may be modified through the use of specific instructions. 


9.2.1 Memory Ordering in the Intel® Pentium® and Intel486™ Processors 


The Pentium and Intel486 processors follow the processor-ordered memory model; however, they operate as 
strongly-ordered processors under most circumstances. Reads and writes always appear in programmed order at 
the system bus—except for the following situation where processor ordering is exhibited. Read misses are 
permitted to go ahead of buffered writes on the system bus when all the buffered writes are cache hits and, there- 
fore, are not directed to the same address being accessed by the read miss. 


In the case of I/O operations, both reads and writes always appear in programmed order. 


Software intended to operate correctly in processor-ordered processors (such as the Pentium 4, Intel Xeon, and P6 
family processors) should not depend on the relatively strong ordering of the Pentium or Intel486 processors. 
Instead, it should ensure that accesses to shared variables that are intended to control concurrent execution 
among processors are explicitly required to obey program ordering through the use of appropriate locking or seri- 
alizing operations (see Section 9.2.5, “Strengthening or Weakening the Memory-Ordering Model”). 
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9.2.2 Memory Ordering in P6 and More Recent Processor Families 


The Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium 4, and P6 family processors also use a processor- 
ordered memory-ordering model that can be further defined as “write ordered with store-buffer forwarding.” This 
model can be characterized as follows. 


In a single-processor system for memory regions defined as write-back cacheable, the memory-ordering model 
respects the following principles (Note the memory-ordering principles for single-processor and multiple- 
processor systems are written from the perspective of software executing on the processor, where the term 
“processor” refers to a logical processor. For example, a physical processor supporting multiple cores and/or Intel 
Hyper-Threading Technology is treated as a multi-processor systems. ): 


¢ Reads are not reordered with other reads. 
¢ Writes are not reordered with older reads. 
¢ Writes to memory are not reordered with other writes, with the following exceptions: 


— streaming stores (writes) executed with the non-temporal move instructions (MOVNTI, MOVNTQ, 
MOVNTDQ, MOVNTPS, and MOVNTPD); and 


— string operations (see Section 9.2.4.1). 


¢ No write to memory may be reordered with an execution of the CLFLUSH instruction; a write may be reordered 
with an execution of the CLFLUSHOPT instruction that flushes a cache line other than the one being written.! 
Executions of the CLFLUSH instruction are not reordered with each other. Executions of CLFLUSHOPT that 
access different cache lines may be reordered with each other. An execution of CLFLUSHOPT may be reordered 
with an execution of CLFLUSH that accesses a different cache line. 


¢ Reads may be reordered with older writes to different locations but not with older writes to the same location. 
¢ Reads or writes cannot be reordered with I/O instructions, locked instructions, or serializing instructions. 
¢ Reads cannot pass earlier LFENCE and MFENCE instructions. 


¢ Writes and executions of CLFLUSH and CLFLUSHOPT cannot pass earlier LFENCE, SFENCE, and MFENCE 
instructions. 


¢ LFENCE instructions cannot pass earlier reads. 

¢ SFENCE instructions cannot pass earlier writes or executions of CLFLUSH and CLFLUSHOPT. 

¢ MFENCE instructions cannot pass earlier reads, writes, or executions of CLFLUSH and CLFLUSHOPT. 
In a multiple-processor system, the following ordering principles apply: 

¢ Individual processors use the same ordering principles as in a single-processor system. 

° Writes by a single processor are observed in the same order by all processors. 

¢ Writes from an individual processor are NOT ordered with respect to the writes from other processors. 
¢ Memory ordering obeys causality (memory ordering respects transitive visibility). 

¢ Any two stores are seen in a consistent order by processors other than those performing the stores 

°® Locked instructions have a total order. 


See the example in Figure 9-1. Consider three processors in a system and each processor performs three writes, 
one to each of three defined locations (A, B, and C). Individually, the processors perform the writes in the same 
program order, but because of bus arbitration and other memory access mechanisms, the order that the three 
processors write the individual memory locations can differ each time the respective code sequences are executed 
on the processors. The final values in location A, B, and C would possibly vary on each execution of the write 
sequence. 


The processor-ordering model described in this section is virtually identical to that used by the Pentium and 
Intel486 processors. The only enhancements in the Pentium 4, Intel Xeon, and P6 family processors are: 


¢ Added support for speculative reads, while still adhering to the ordering principles above. 
° Store-buffer forwarding, when a read passes a write to the same memory location. 


1. Earlier versions of this manual specified that writes to memory may be reordered with executions of the CLFLUSH instruction. No 
processors implementing the CLFLUSH instruction allow such reordering. 
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® Out of order store from long string store and string move operations (see Section 9.2.4, “Fast-String Operation 
and Out-of-Order Stores,” below). 


Order of Writes From Individual Processors 


Processor #1 Processor #2 Processor #3 
Each processor — Write A.1 Write A.2 Write A.3 
is guaranteed to ~ | write B14 Write B.2 Write B.3 
perform writes in — write C.1 Write C.2 Write C.3 


program order. 


Example of order of actual writes 
from all processors to memory 


Writes are in order Write A.1 — 

with respect to Write B.1 

individual processes. Write A.2 Writes from all 
Write A.3 processors are 
Write C.1. |--» not guaranteed 
Write B.2 to occur ina 
Write C.2 particular order. 
Write B.3 
Write C.3 — 


Figure 9-1. Example of Write Ordering in Multiple-Processor Systems 


NOTE 


In P6 processor family, store-buffer forwarding to reads of WC memory from streaming stores to 
the same address does not occur due to errata. 


9.2.3 Examples Illustrating the Memory-Ordering Principles 


This section provides a set of examples that illustrate the behavior of the memory-ordering principles introduced in 
Section 9.2.2. They are designed to give software writers an understanding of how memory ordering may affect the 
results of different sequences of instructions. 


These examples are limited to accesses to memory regions defined as write-back cacheable (WB). (Section 9.2.3.1 
describes other limitations on the generality of the examples.) The reader should understand that they describe 
only software-visible behavior. A logical processor may reorder two accesses even if one of examples indicates that 
they may not be reordered. Such an example states only that software cannot detect that such a reordering 
occurred. Similarly, a logical processor may execute a memory access more than once as long as the behavior 
visible to software is consistent with a single execution of the memory access. 


8.2.3.1 


As noted above, the examples in this section are limited to accesses to memory regions defined as write-back 
cacheable (WB). They apply only to ordinary loads stores and to locked read-modify-write instructions. They do not 
necessarily apply to any of the following: out-of-order stores for string instructions (See Section 9.2.4); accesses 
with a non-temporal hint; reads from memory by the processor as part of address translation (e.g., page walks); 
and updates to segmentation and paging structures by the processor (e.g., to update “accessed” bits). 


Assumptions, Terminology, and Notation 


The principles underlying the examples in this section apply to individual memory accesses and to locked read- 
modify-write instructions. The Intel-64 memory-ordering model guarantees that, for each of the following 
memory-access instructions, the constituent memory operation appears to execute as a single memory access: 


¢ Instructions that read or write a single byte. 
¢ Instructions that read or write a word (2 bytes) whose address is aligned on a 2 byte boundary. 
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¢ Instructions that read or write a doubleword (4 bytes) whose address is aligned on a 4 byte boundary. 
¢ Instructions that read or write a quadword (8 bytes) whose address is aligned on an 8 byte boundary. 


Any locked instruction (either the XCHG instruction or another read-modify-write instruction with a LOCK prefix) 
appears to execute as an indivisible and uninterruptible sequence of load(s) followed by store(s) regardless of 
alignment. 


Other instructions may be implemented with multiple memory accesses. From a memory-ordering point of view, 
there are no guarantees regarding the relative order in which the constituent memory accesses are made. There is 
also no guarantee that the constituent operations of a store are executed in the same order as the constituent 
operations of a load. 


Section 9.2.3.2 through Section 9.2.3.7 give examples using the MOV instruction. The principles that underlie 
these examples apply to load and store accesses in general and to other instructions that load from or store to 
memory. Section 9.2.3.8 and Section 9.2.3.9 give examples using the XCHG instruction. The principles that 
underlie these examples apply to other locked read-modify-write instructions. 


This section uses the term “processor” is to refer to a logical processor. The examples are written using Intel-64 
assembly-language syntax and use the following notational conventions: 


¢ Arguments beginning with an “r”, such as ri or r2 refer to registers (e.g., EAX) visible only to the processor 
being considered. 


¢ Memory locations are denoted with x, y, z. 
¢ Stores are written as mov [ _ x], val, which implies that va/ is being stored into the memory location x. 


¢ Loads are written as mov r, [ _x], which implies that the contents of the memory location x are being loaded 
into the register r. 


As noted earlier, the examples refer only to software visible behavior. When the succeeding sections make state- 
ment such as “the two stores are reordered,” the implication is only that “the two stores appear to be reordered 
from the point of view of software.” 


9.2.3.2 Neither Loads Nor Stores Are Reordered with Like Operations 


The Intel-64 memory-ordering model allows neither loads nor stores to be reordered with the same kind of opera- 
tion. That is, it ensures that loads are seen in program order and that stores are seen in program order. This is illus- 
trated by the following example: 
Example 9-1. Stores Are Not Reordered with Other Stores 

Processor 0 Processor 1 


mov [ _x], 1 mov r1,[_y] 
mov [ _y], 1 mov r2, [ _x] 


Initially x = y =0 


rl =1 andr2 = Ois not allowed 


The disallowed return values could be exhibited only if processor 0’s two stores are reordered (with the two loads 
occurring between them) or if processor 1’s two loads are reordered (with the two stores occurring between them). 


If ri = 1, the store to y occurs before the load from y. Because the Intel-64 memory-ordering model does not allow 


stores to be reordered, the earlier store to x occurs before the load from y. Because the Intel-64 memory-ordering 
model does not allow loads to be reordered, the store to x also occurs before the later load from x. This r2 = 1. 


9.2.3.3 Stores Are Not Reordered With Earlier Loads 


The Intel-64 memory-ordering model ensures that a store by a processor may not occur before a previous load by 
the same processor. This is illustrated in Example 9-2. 
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Example 9-2. Stores Are Not Reordered with Older Loads 


Processor 0 Processor 1 


mov rl, [ _x] mov r2, [_y] 
mov [_y], 1 mov [ _x], 1 


Initially x = y =O 


r1 = 1 andr2 = 1 is not allowed 


Assume ri = 1. 
® Because ri = 1, processor 1’s store to x occurs before processor 0’s load from x. 


¢ Because the Intel-64 memory-ordering model prevents each store from being reordered with the earlier load 
by the same processor, processor 1’s load from y occurs before its store to x. 


¢ Similarly, processor 0’s load from x occurs before its store to y. 
¢ Thus, processor 1’s load from y occurs before processor 0’s store to y, implying r2 = 0. 


9.2.3.4 Loads May Be Reordered with Earlier Stores to Different Locations 


The Intel-64 memory-ordering model allows a load to be reordered with an earlier store to a different location. 
However, loads are not reordered with stores to the same location. 


The fact that a load may be reordered with an earlier store to a different location is illustrated by the following 
example: 


Example 9-3. Loads May be Reordered with Older Stores 


Processor 0 Processor 1 


mov [ _x], 1 mov [_y], 1 
movr1,[_y] mov r2, [ _x] 


Initially x = y =0 


1 =Oandr2 = Ois allowed 


At each processor, the load and the store are to different locations and hence may be reordered. Any interleaving 
of the operations is thus allowed. One such interleaving has the two loads occurring before the two stores. This 
would result in each load returning value 0. 


The fact that a load may not be reordered with an earlier store to the same location is illustrated by the following 
example: 
Example 9-4. Loads Are not Reordered with Older Stores to the Same Location 

Processor 0 


mov [ _x], 1 
mov r1, [ __x] 


Initially x = 0 


r1 = Ois not allowed 


The Intel-64 memory-ordering model does not allow the load to be reordered with the earlier store because the 
accesses are to the same location. Therefore, r1 = 1 must hold. 
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9.2.35 Intra-Processor Forwarding Is Allowed 


The memory-ordering model allows concurrent stores by two processors to be seen in different orders by those two 
processors; specifically, each processor may perceive its own store occurring before that of the other. This is illus- 
trated by the following example: 


Example 9-5. Intra-Processor Forwarding is Allowed 


Processor 0 Processor 1 
mov [_x], 1 mov [_y], 1 
mov r1, [ _x] mov r3, [_y] 
mov r2, [ _y] mov r4, [_x] 
Initially x = y = 0 
r2 = 0 andr4 = Ois allowed 


The memory-ordering model imposes no constraints on the order in which the two stores appear to execute by the 
two processors. This fact allows processor 0 to see its store before seeing processor 1's, while processor 1 sees its 
store before seeing processor O's. (Each processor is self consistent.) This allows r2 = 0 and r4 = 0. 


In practice, the reordering in this example can arise as a result of store-buffer forwarding. While a store is tempo- 
rarily held in a processor's store buffer, it can satisfy the processor's own loads but is not visible to (and cannot 
satisfy) loads by other processors. 


9.2.3.6 Stores Are Transitively Visible 


The memory-ordering model ensures transitive visibility of stores; stores that are causally related appear to all 
processors to occur in an order consistent with the causality relation. This is illustrated by the following example: 


Example 9-6. Stores Are Transitively Visible 


Processor 0 Processor 1 Processor 2 
mov [_x], 1 mov r1, [ __x] 
mov [_y], 1 mov r2, [ _y] 
mov r3, [_x] 
Initially x = y =0 
r1=1,r2 = 1,r3 = Ois not allowed 


Assume that ri = 1 andr2 = 1. 
¢ Because ri = 1, processor 0’s store occurs before processor 1’s load. 


¢ Because the memory-ordering model prevents a store from being reordered with an earlier load (see Section 


9.2.3.3), processor 1’s load occurs before its store. Thus, processor 0’s store causally precedes processor 1’s 
store. 


Because processor 0’s store causally precedes processor 1’s store, the memory-ordering model ensures that 
processor 0’s store appears to occur before processor 1’s store from the point of view of all processors. 


¢ Because r2 = 1, processor 1’s store occurs before processor 2’s load. 


Because the Intel-64 memory-ordering model prevents loads from being reordered (see Section 9.2.3.2), 
processor 2’s load occur in order. 


The above items imply that processor 0’s store to x occurs before processor 2's load from x. This implies that 
r3 = 1. 
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9.2.3.7 Stores Are Seen in a Consistent Order by Other Processors 


As noted in Section 9.2.3.5, the memory-ordering model allows stores by two processors to be seen in different 
orders by those two processors. However, any two stores must appear to execute in the same order to all proces- 
sors other than those performing the stores. This is illustrated by the following example: 


Example 9-7. Stores Are Seen in a Consistent Order by Other Processors 


Processor 0 


Processor 1 


Processor 2 


Processor 3 


mov [ _x], 1 


mov [_y], 1 


mov r1,[ _x] 
mov r2,[_y] 


mov r3, [_y] 
mov r4, [_x] 


Initially x = y =O 


r1=1,r2 = 0,r3 = 1,4 = Ois not allowed 


By the principles discussed in Section 9.2.3.2: 
¢® Processor 2’s first and second load cannot be reordered. 
¢ Processor 3’s first and second load cannot be reordered. 
¢ Ifri = 1andr2 =O, processor 0’s store appears to precede processor 1’s store with respect to processor 2. 

¢ Similarly, r3 = 1 and r4 = 0 imply that processor 1’s store appears to precede processor 0O’s store with respect 


to processor 1. 


Because the memory-ordering model ensures that any two stores appear to execute in the same order to all 
processors (other than those performing the stores), this set of return values is not allowed. 


9.2.3.8 Locked Instructions Have a Total Order 


The memory-ordering model ensures that all processors agree on a single execution order of all locked instructions, 
including those that are larger than 8 bytes or are not naturally aligned. This is illustrated by the following example: 


Example 9-8. Locked Instructions Have a Total Order 


Processor 0 


Processor 1 


Processor 2 


Processor 3 


xchg [ _x], 71 


xchg [_y], r2 


mov r3, [ __x] 
mov r4, [_y] 


mov r5, [_y] 
mov r6, [_x] 


Initially r1 =r2 =1,x=y=0 
r3 = 1,r4 = 0,5 = 1, r6 = Ois not allowed 


Processor 2 and processor 3 must agree on the order of the two executions of XCHG. Without loss of generality, 
suppose that processor 0’s XCHG occurs first. 


e Ifr5 = 1, processor 1’s XCHG into y occurs before processor 3’s load from y. 


° Because the Intel-64 memory-ordering model prevents loads from being reordered (see Section 9.2.3.2), 
processor 3’s loads occur in order and, therefore, processor 1’s XCHG occurs before processor 3’s load from x. 


® Since processor 0’s XCHG into x occurs before processor 1’s XCHG (by assumption), it occurs before 
processor 3’s load from x. Thus, r6 = 1. 


A similar argument (referring instead to processor 2’s loads) applies if processor 1’s XCHG occurs before 
processor 0’s XCHG. 


9.2.3.9 Loads and Stores Are Not Reordered with Locked Instructions 


The memory-ordering model prevents loads and stores from being reordered with locked instructions that execute 
earlier or later. The examples in this section illustrate only cases in which a locked instruction is executed before a 


9-12 Vol. 3A 


MULTIPLE-PROCESSOR MANAGEMENT 


load or a store. The reader should note that reordering is prevented also if the locked instruction is executed after 
a load or a store. 


The first example illustrates that loads may not be reordered with earlier locked instructions: 
Example 9-9. Loads Are not Reordered with Locks 

Processor 0 Processor 1 
xchg [ _x], 71 xchg [_y], r3 
mov r2, [_y] mov 4, [_x] 
Initially x = y=0,r1 =r3=1 


r2 =O andr4 = Ois not allowed 


As explained in Section 9.2.3.8, there is a total order of the executions of locked instructions. Without loss of 
generality, suppose that processor 0’s XCHG occurs first. 


Because the Intel-64 memory-ordering model prevents processor 1’s load from being reordered with its earlier 
XCHG, processor 0’s XCHG occurs before processor 1’s load. This implies r4 = 1. 


A similar argument (referring instead to processor 2’s accesses) applies if processor 1’s XCHG occurs before 
processor 0’s XCHG. 


The second example illustrates that a store may not be reordered with an earlier locked instruction: 
Example 9-10. Stores Are not Reordered with Locks 
Processor O Processor 1 


xchg [ _x], 1 mov r2, [_y] 


mov [_y], 1 mov r3, [ _x] 


Initially x = y =0,r1 =1 


r2 = 1 andr3 = Ois not allowed 


Assume r2 = 1. 
¢ Because r2 = 1, processor 0’s store to y occurs before processor 1’s load from y. 


¢ Because the memory-ordering model prevents a store from being reordered with an earlier locked instruction, 
processor 0’s XCHG into x occurs before its store to y. Thus, processor 0’s XCHG into x occurs before 
processor 1's load from y. 


¢ Because the memory-ordering model prevents loads from being reordered (see Section 9.2.3.2), processor 1’s 
loads occur in order and, therefore, processor 1’s XCHG into x occurs before processor 1’s load from x. Thus, 
r3 = 1. 


9.2.4 Fast-String Operation and Out-of-Order Stores 


Section 7.3.9.3 of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, described an optimi- 
zation of repeated string operations called fast-string operation. 


As explained in that section, the stores produced by fast-string operation may appear to execute out of order. Soft- 
ware dependent upon sequential store ordering should not use string operations for the entire data structure to be 
stored. Data and semaphores should be separated. Order-dependent code should write to a discrete semaphore 
variable after any string operations to allow correctly ordered data to be seen by all processors. Atomicity of load 
and store operations is guaranteed only for native data elements of the string with native data size, and only if they 
are included in a single cache line. 


Section 9.2.4.1 and Section 9.2.4.2 provide further explain and examples. 


9.2.4.1 Memory-Ordering Model for String Operations on Write-Back (WB) Memory 


This section deals with the memory-ordering model for string operations on write-back (WB) memory for the Intel 
64 architecture. 
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The memory-ordering model respects the follow principles: 
1. Stores within a single string operation may be executed out of order. 


2. Stores from separate string operations (for example, stores from consecutive string operations) do not execute 
out of order. All the stores from an earlier string operation will complete before any store from a later string 
operation. 


3. String operations are not reordered with other store operations. 


Fast string operations (e.g., string operations initiated with the MOVS/STOS instructions and the REP prefix) may 
be interrupted by exceptions or interrupts. The interrupts are precise but may be delayed - for example, the inter- 
ruptions may be taken at cache line boundaries, after every few iterations of the loop, or after operating on every 
few bytes. Different implementations may choose different options, or may even choose not to delay interrupt 
handling, so software should not rely on the delay. When the interrupt/trap handler is reached, the source/destina- 
tion registers point to the next string element to be operated on, while the EIP stored in the stack points to the 
string instruction, and the ECX register has the value it held following the last successful iteration. The return from 
that trap/interrupt handler should cause the string instruction to be resumed from the point where it was inter- 
rupted. 


The string operation memory-ordering principles, (item 2 and 3 above) should be interpreted by taking the incor- 
ruptibility of fast string operations into account. For example, if a fast string operation gets interrupted after k iter- 
ations, then stores performed by the interrupt handler will become visible after the fast string stores from iteration 
0 to k, and before the fast string stores from the (k+1)th iteration onward. 


Stores within a single string operation may execute out of order (item 1 above) only if fast string operation is 
enabled. Fast string operations are enabled/disabled through the IA32_MISC_ENABLE model specific register. 


9.2.4.2 Examples Illustrating Memory-Ordering Principles for String Operations 
The following examples uses the same notation and convention as described in Section 9.2.3.1. 


In Example 9-11, processor 0 does one round of (128 iterations) doubleword string store operation via rep:stosd, 
writing the value 1 (value in EAX) into a block of 512 bytes from location _x (kept in ES:EDI) in ascending order. 
Since each operation stores a doubleword (4 bytes), the operation is repeated 128 times (value in ECX). The block 
of memory initially contained 0. Processor 1 is reading two memory locations that are part of the memory block 
being updated by processor 0, i.e, reading locations in the range _x to (_x+511). 


Example 9-11. Stores Within a String Operation May be Reordered 
Processor 0 Processor 1 


rep:stosd [ _x] mov r1,[_z] 


mov r2,[_y] 


Initially on processor O: EAX = 1, ECX=128, ES:EDI =_x 
Initially [_x] to 511[_x]= 0, _x <=_y <_z<_x+512 
r1 = 1 andr2 = Ois allowed 


It is possible for processor 1 to perceive that the repeated string stores in processor 0 are happening out of order. 
Assume that fast string operations are enabled on processor 0. 


In Example 9-12, processor 0 does two separate rounds of rep stosd operation of 128 doubleword stores, writing 
the value 1 (value in EAX) into the first block of 512 bytes from location _x (kept in ES:EDI) in ascending order. It 
then writes 1 into a second block of memory from (_x+512) to (_x+1023). All of the memory locations initially 
contain 0. The block of memory initially contained 0. Processor 1 performs two load operations from the two blocks 
of memory. 
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Example 9-12. Stores Across String Operations Are not Reordered 
Processor 0 


Processor 1 


rep:stosd [ _x] 


mov r1,[_z] 
mov ecx, $128 


mov r2, [_y] 
rep:stosd 512[ _x] 

Initially on processor O: EAX = 1, ECX=128, ES:EDI =_x 

Initially [_x] to 1023[_x]= 0, _x <=_y < __x+512 <_z <_x+1024 
r1 = 1 andr2 = Ois not allowed 


It is not possible in the above example for processor 1 to perceive any of the stores from the later string operation 


(to the second 512 block) in processor 0 before seeing the stores from the earlier string operation to the first 512 
block. 


The above example assumes that writes to the second block (_x+512 to _x+1023) does not get executed while 
processor 0’s string operation to the first block has been interrupted. If the string operation to the first block by 
processor 0 is interrupted, and a write to the second memory block is executed by the interrupt handler, then that 
change in the second memory block will be visible before the string operation to the first memory block resumes. 


In Example 9-13, processor 0 does one round of (128 iterations) doubleword string store operation via rep:stosd, 
writing the value 1 (value in EAX) into a block of 512 bytes from location _x (kept in ES:EDI) in ascending order. It 
then writes to a second memory location outside the memory block of the previous string operation. Processor 1 
performs two read operations, the first read is from an address outside the 512-byte block but to be updated by 
processor 0, the second ready is from inside the block of memory of string operation. 


Example 9-13. String Operations Are not Reordered with later Stores 
Processor 0 


Processor 1 


rep:stosd [ _x] mov r1,[_z] 


mov [_z], $1 mov r2, [_y] 

Initially on processor O: EAX = 1, ECX=128, ES:EDI =_x 

Initially [_y] = [_z] = 0, [_x] to 511[_x]= 0, _x <=_y < __x+512, _z is a separate memory location 
r1 = 1 andr2 = Ois not allowed 


Processor 1 cannot perceive the later store by processor 0 until it sees all the stores from the string operation. 
Example 9-13 assumes that processor 0’s store to [_z] is not executed while the string operation has been inter- 
rupted. If the string operation is interrupted and the store to [_z] by processor 0 is executed by the interrupt 
handler, then changes to [_z] will become visible before the string operation resumes. 


Example 9-14 illustrates the visibility principle when a string operation is interrupted. 


Example 9-14. Interrupted String Operation 


Processor 0 Processor 1 
rep:stosd [ _x] // interrupted before es:edi reach _y mov rl, [_z] 
mov [_Z], $1 // interrupt handler mov r2,[_y] 


Initially on processor O: EAX = 1, ECX=128, ES:EDI =_x 


Initially [_y] = [_z] = 0, [_x] to 511[_x]= 0, _x <= _y < _x+512,_z is a separate memory location 
r1 = 1 andr2 = Ois allowed 
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In Example 9-14, processor 0 started a string operation to write to a memory block of 512 bytes starting at address 
_x. Processor 0 got interrupted after k iterations of store operations. The address _y has not yet been updated by 
processor 0 when processor 0 got interrupted. The interrupt handler that took control on processor 0 writes to the 
address _z. Processor 1 may see the store to _z from the interrupt handler, before seeing the remaining stores to 
the 512-byte memory block that are executed when the string operation resumes. 


Example 9-15 illustrates the ordering of string operations with earlier stores. No store from a string operation can 
be visible before all prior stores are visible. 


Example 9-15. String Operations Are not Reordered with Earlier Stores 
Processor 0 Processor 1 


mov [_z], $1 mov r1,[_y] 


rep:stosd [ _x] mov r2, [ _z] 
Initially on processor O: EAX = 1, ECX=128, ES:EDI =_x 
Initially [_y] = [_2] = 0, [_x] to 511[_x]= 0, _x <=_y < __x+512,_2 is a separate memory location 


r1 = 1 andr2 = Ois not allowed 


9.2.5 Strengthening or Weakening the Memory-Ordering Model 


The Intel 64 and IA-32 architectures provide several mechanisms for strengthening or weakening the memory- 
ordering model to handle special programming situations. These mechanisms include: 


¢ The I/O instructions, locked instructions, the LOCK prefix, and serializing instructions force stronger ordering 
on the processor. 


° The SFENCE instruction (introduced to the IA-32 architecture in the Pentium III processor) and the LFENCE and 
MFENCE instructions (introduced in the Pentium 4 processor) provide memory-ordering and serialization 
capabilities for specific types of memory operations. 


¢ The memory type range registers (MTRRs) can be used to strengthen or weaken memory ordering for specific 
area of physical memory (see Section 12.11, “Memory Type Range Registers (MTRRs)”). MTRRs are available 
only in the Pentium 4, Intel Xeon, and P6 family processors. 


° The page attribute table (PAT) can be used to strengthen memory ordering for a specific page or group of pages 
(see Section 12.12, “Page Attribute Table (PAT)”). The PAT is available only in the Pentium 4, Intel Xeon, and 
Pentium III processors. 


These mechanisms can be used as follows: 


Memory mapped devices and other I/O devices on the bus are often sensitive to the order of writes to their I/O 
buffers. I/O instructions can be used to (the IN and OUT instructions) impose strong write ordering on such 
accesses as follows. Prior to executing an I/O instruction, the processor waits for all previous instructions in the 
program to complete and for all buffered writes to drain to memory. Only instruction fetch and page tables walks 
can pass I/O instructions. Execution of subsequent instructions do not begin until the processor determines that 
the I/O instruction has been completed. 


Synchronization mechanisms in multiple-processor systems may depend upon a strong memory-ordering model. 
Here, a program can use a locked instruction such as the XCHG instruction or the LOCK prefix to ensure that a read- 
modify-write operation on memory is carried out atomically. Locked instructions typically operate like I/O instruc- 
tions in that they wait for all previous memory accesses to complete and for all buffered writes to drain to memory 
(see Section 9.1.2, “Bus Locking”). Unlike I/O operations, locked instructions do not wait for all previous instruc- 
tions to complete execution. 


Program synchronization can also be carried out with serializing instructions (see Section 9.3). These instructions 
are typically used at critical procedure or task boundaries to force completion of all previous instructions before a 
jump to a new section of code or a context switch occurs. Like the I/O instructions, the processor waits until all 
previous instructions have been completed and all buffered writes have been drained to memory before executing 
the serializing instruction. 
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The SFENCE, LFENCE, and MFENCE instructions provide a performance-efficient way of ensuring load and store 
memory ordering between routines that produce weakly-ordered results and routines that consume that data. The 
functions of these instructions are as follows: 


¢ SFENCE — Serializes all store (write) operations that occurred prior to the SFENCE instruction in the program 
instruction stream, but does not affect load operations. 


¢ LFENCE — Serializes all load (read) operations that occurred prior to the LFENCE instruction in the program 
instruction stream, but does not affect store operations. 


¢ MFENCE — Serializes all store and load operations that occurred prior to the MFENCE instruction in the 
program instruction stream. 


Note that the SFENCE, LFENCE, and MFENCE instructions provide a more efficient method of controlling memory 
ordering than the CPUID instruction. 


The MTRRs were introduced in the P6 family processors to define the cache characteristics for specified areas of 
physical memory. The following are two examples of how memory types set up with MTRRs can be used strengthen 
or weaken memory ordering for the Pentium 4, Intel Xeon, and P6 family processors: 


¢ The strong uncached (UC) memory type forces a strong-ordering model on memory accesses. Here, all reads 
and writes to the UC memory region appear on the bus and out-of-order or speculative accesses are not 
performed. This memory type can be applied to an address range dedicated to memory mapped I/O devices to 
force strong memory ordering. 


¢ For areas of memory where weak ordering is acceptable, the write back (WB) memory type can be chosen. 
Here, reads can be performed speculatively and writes can be buffered and combined. For this type of memory, 
cache locking is performed on atomic (locked) operations that do not split across cache lines, which helps to 
reduce the performance penalty associated with the use of the typical synchronization instructions, such as 
XCHG, that lock the bus during the entire read-modify-write operation. With the WB memory type, the XCHG 
instruction locks the cache instead of the bus if the memory access is contained within a cache line. 


The PAT was introduced in the Pentium III processor to enhance the caching characteristics that can be assigned to 
pages or groups of pages. The PAT mechanism typically used to strengthen caching characteristics at the page level 
with respect to the caching characteristics established by the MTRRs. Table 12-7 shows the interaction of the PAT 
with the MTRRs. 


Intel recommends that software written to run on Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium 4, Intel 
Xeon, and P6 family processors assume the processor-ordering model or a weaker memory-ordering model. The 
Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium 4, Intel Xeon, and P6 family processors do not implement a 
strong memory-ordering model, except when using the UC memory type. Despite the fact that Pentium 4, Intel 
Xeon, and P6 family processors support processor ordering, Intel does not guarantee that future processors will 
support this model. To make software portable to future processors, it is recommended that operating systems 
provide critical region and resource control constructs and API’s (application program interfaces) based on I/O, 
locking, and/or serializing instructions be used to synchronize access to shared areas of memory in multiple- 
processor systems. Also, software should not depend on processor ordering in situations where the system hard- 
ware does not support this memory-ordering model. 


9.3 SERIALIZING INSTRUCTIONS 


The Intel 64 and JA-32 architectures define several serializing instructions. These instructions force the 
processor to complete all modifications to flags, registers, and memory by previous instructions and to drain all 
buffered writes to memory before the next instruction is fetched and executed. For example, when a MOV to 
control register instruction is used to load a new value into control register CRO to enable protected mode, the 
processor must perform a Serializing operation before it enters protected mode. This serializing operation ensures 


1. Specifically, LFENCE does not execute until all prior instructions have completed locally, and no later instruction begins execution 
until LFENCE completes. As a result, an instruction that loads from memory and that precedes an LFENCE receives data from mem- 
ory prior to completion of the LFENCE. An LFENCE that follows an instruction that stores to memory might complete before the data 
being stored have become globally visible. Instructions following an LFENCE may be fetched from memory before the LFENCE, but 
they will not execute until the LFENCE completes. 
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that all operations that were started while the processor was in real-address mode are completed before the switch 
to protected mode is made. 


The concept of serializing instructions was introduced into the IA-32 architecture with the Pentium processor to 
support parallel instruction execution. Serializing instructions have no meaning for the Intel486 and earlier proces- 
sors that do not implement parallel instruction execution. 


It is important to note that executing of serializing instructions on P6 and more recent processor families constrain 
speculative execution because the results of speculatively executed instructions are discarded. The following 
instructions are serializing instructions: 


° Privileged serializing instructions — INVD, INVEPT, INVLPG, INVVPID, LGDT, LIDT, LLDT, LTR, MOV (to 
control register, with the exception of MOV CR8!), MOV (to debug register), WBINVD, and WRMSR2. 


° Non-privileged serializing instructions — CPUID, IRET, RSM, and SERIALIZE. 


When the processor serializes instruction execution, it ensures that all pending memory transactions are completed 
(including writes stored in its store buffer) before it executes the next _instruction. Nothing can pass a serializing 
instruction and a Serializing instruction cannot pass any other instruction (read, write, instruction fetch, or I/O). For 
example, CPUID can be executed at any privilege level to serialize instruction execution with no effect on program 
flow, except that the EAX, EBX, ECX, and EDX registers are modified. 


The following instructions are memory-ordering instructions, not serializing instructions. These drain the data 
memory subsystem. They do not serialize the instruction execution stream: 


¢ Non-privileged memory-ordering instructions — SFENCE, LFENCE, and MFENCE. 


The SFENCE, LFENCE, and MFENCE instructions provide more granularity in controlling the serialization of memory 
loads and stores (see Section 9.2.5, “Strengthening or Weakening the Memory-Ordering Model”). 


The following additional information is worth noting regarding serializing instructions: 


¢ The processor does not write back the contents of modified data in its data cache to external memory when it 
serializes instruction execution. Software can force modified data to be written back by executing the WBINVD 
instruction, which is a serializing instruction. The amount of time or cycles for WBINVD to complete will vary 
due to the size of different cache hierarchies and other factors. As a consequence, the use of the WBINVD 
instruction can have an impact on interrupt/event response time. 


¢ When an instruction is executed that enables or disables paging (that is, changes the PG flag in control register 
CRO), the instruction should be followed by a jump instruction. The target instruction of the jump instruction is 
fetched with the new setting of the PG flag (that is, paging is enabled or disabled), but the jump instruction 
itself is fetched with the previous setting. The Pentium 4, Intel Xeon, and P6 family processors do not require 
the jump operation following the move to register CRO (because any use of the MOV instruction in a Pentium 4, 
Intel Xeon, or P6 family processor to write to CRO is completely serializing). However, to maintain backwards 
and forward compatibility with code written to run on other IA-32 processors, it is recommended that the jump 
operation be performed. 


¢ Whenever an instruction is executed to change the contents of CR3 while paging is enabled, the next instruction 
is fetched using the translation tables that correspond to the new value of CR3. Therefore the next instruction 
and the sequentially following instructions should have a mapping based upon the new value of CR3. (Global 
entries in the TLBs are not invalidated, see Section 4.10.4, “Invalidation of TLBs and Paging-Structure 
Caches.”) 

¢ The Pentium processor and more recent processor families use branch-prediction techniques to improve 


performance by prefetching the destination of a branch instruction before the branch instruction is executed. 
Consequently, instruction execution is not deterministically serialized when a branch instruction is executed. 


MOV CR8 is not defined architecturally as a serializing instruction. 

2. Anexecution of WRMSR to any non-serializing MSR is not serializing. Non-serializing MSRs include the following: |A32_SPEC_CTRL 
MSR (MSR index 48H), |A32_PRED_CMD MSR (MSR index 49H), IA32_TSX_CTRL MSR (MSR index 122H), IA32_TSC_DEADLINE MSR 
(MSR index 6EOH), IA32_PKRS MSR (MSR index 6€1H), [A32_HWP_REQUEST MSR (MSR index 774H), or any of the x2APIC MSRs 
(MSR indices 802H to 83FH). 

3. LFENCE does provide some guarantees on instruction ordering. It does not execute until all prior instructions have completed locally, 
and no later instruction begins execution until LFENCE completes. 
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9.4 MULTIPLE-PROCESSOR (MP) INITIALIZATION 


The IA-32 architecture (beginning with the P6 family processors) defines a multiple-processor (MP) initialization 
protocol called the Multiprocessor Specification Version 1.4. This specification defines the boot protocol to be used 
by IA-32 processors in multiple-processor systems. (Here, multiple processors is defined as two or more proces- 
sors.) The MP initialization protocol has the following important features: 


¢ It supports controlled booting of multiple processors without requiring dedicated system hardware. 


¢ It allows hardware to initiate the booting of a system without the need for a dedicated signal or a predefined 
boot processor. 


¢ It allows all IA-32 processors to be booted in the same manner, including those supporting Intel Hyper- 
Threading Technology. 


¢ The MP initialization protocol also applies to MP systems using Intel 64 processors. 


The mechanism for carrying out the MP initialization protocol differs depending on the Intel processor generations. 
The following bullets summarizes the evolution of the changes: 


° For P6 family or older processors supporting MP operations— The selection of the BSP and APs (see 
Section 9.4.1, “BSP and AP Processors”) is handled through arbitration on the APIC bus, using BIPI and FIPI 
messages. These processor generations have CPUID signatures of (family=O6H, extended_model=0, 
model<=ODH), or family <O6H. See Section 9.11.1, “Overview of the MP Initialization Process for P6 Family 
Processors,” for a complete discussion of MP initialization for P6 family processors. 


¢ Early generations of IA processors with family OFH — The selection of the BSP and APs (see Section 
9.4.1, “BSP and AP Processors”) is handled through arbitration on the system bus, using BIPI and FIPI 
messages (see Section 9.4.3, “MP Initialization Protocol Algorithm for MP Systems”). These processor 
generations have CPUID signatures of family=OFH, model=0H, stepping<=09H. 


¢ Later generations of IA processors with family OFH, and IA processors with system bus — The 
selection of the BSP and APs is handled through a special system bus cycle, without using BIPI and FIPI 
message arbitration (see Section 9.4.3, “MP Initialization Protocol Algorithm for MP Systems”). These 
processor generations have CPUID signatures of family=OFH with (model=0H, stepping>=OAH) or (model >0, 
all steppings); or family=06H, extended_model=0, model>=OEH. 


¢ All other modern IA processor generations supporting MP operations— The selection of the BSP and 
APs in the system is handled by platform-specific arrangement of the combination of hardware, BIOS, and/or 
configuration input options. The basis of the selection mechanism is similar to those of the Later generations of 
family OFH and other Intel processor using system bus (see Section 9.4.3, “MP Initialization Protocol Algorithm 
for MP Systems”). These processor generations have CPUID signatures of family=O6H, extended_model>0. 


The family, model, and stepping ID for a processor is given in the EAX register when the CPUID instruction is 
executed with a value of 1 in the EAX register. 


9.4.1 BSP and AP Processors 


The MP initialization protocol defines two classes of processors: the bootstrap processor (BSP) and the application 
processors (APs). Following a power-up or RESET of an MP system, system hardware dynamically selects one of 
the processors on the system bus as the BSP. The remaining processors are designated as APs. 


As part of the BSP selection mechanism, the BSP flag is set in the IA32_APIC_BASE MSR (see Figure 11-5) of the 
BSP, indicating that it is the BSP. This flag is cleared for all other processors. 


The BSP executes the BIOS’s boot-strap code to configure the APIC environment, sets up system-wide data struc- 
tures, and starts and initializes the APs. When the BSP and APs are initialized, the BSP then begins executing the 
operating-system initialization code. 


Following a power-up or reset, the APs complete a minimal self-configuration, then wait for a startup signal (a SIPI 
message) from the BSP processor. Upon receiving a SIPI message, an AP executes the BIOS AP configuration code, 
which ends with the AP being placed in halt state. 


For Intel 64 and IA-32 processors supporting Intel Hyper-Threading Technology, the MP initialization protocol treats 
each of the logical processors on the system bus or coherent link domain as a separate processor (with a unique 
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APIC ID). During boot-up, one of the logical processors is selected as the BSP and the remainder of the logical 
processors are designated as APs. 


9.4.2 


MP Initialization Protocol Requirements and Restrictions 


The MP initialization protocol imposes the following requirements and restrictions on the system: 


¢ The MP protocol is executed only after a power-up or RESET. If the MP protocol has completed and a BSP is 
chosen, subsequent INITs (either to a specific processor or system wide) do not cause the MP protocol to be 
repeated. Instead, each logical processor examines its BSP flag (in the IA32_APIC_BASE MSR) to determine 
whether it should execute the BIOS boot-strap code (if it is the BSP) or enter a wait-for-SIPI state (if it is an 


AP). 


e All devices in the system that are capable of delivering interrupts to the processors must be inhibited from 
doing so for the duration of the MP initialization protocol. The time during which interrupts must be inhibited 
includes the window between when the BSP issues an INIT-SIPI-SIPI sequence to an AP and when the AP 
responds to the last SIPI in the sequence. 


9.4.3 


MP Initialization Protocol Algorithm for MP Systems 


Following a power-up or RESET of an MP system, the processors in the system execute the MP initialization protocol 
algorithm to initialize each of the logical processors on the system bus or coherent link domain. In the course of 
executing this algorithm, the following boot-up and initialization operations are carried out: 


1. Each logical processor is assigned a unique APIC ID, based on system topology. The unique ID is a 32-bit value 
if the processor supports CPUID leaf OBH, otherwise the unique ID is an 8-bit value. (see Section 9.4.5, “Identi- 
fying Logical Processors in an MP System”). 


Each logical processor is assigned a unique arbitration priority based on its APIC ID. 


Each logical processor executes its internal BIST simultaneously with the other logical processors in the 
system. 


4. Upon completion of the BIST, the logical processors use a hardware-defined selection mechanism to select the 
BSP and the APs from the available logical processors on the system bus. The BSP selection mechanism differs 
depending on the family, model, and stepping IDs of the processors, as follows: 


— Later generations of IA processors within family OFH (see Section 9.4), IA processors with system bus 
(family=06H, extended_model=0, model>=OEH), or all other modern Intel processors (family=O6H, 
extended_model>0): 


The logical processors begin monitoring the BNR# signal, which is toggling. When the BNR# pin stops 
toggling, each processor attempts to issue a NOP special cycle on the system bus. 


The logical processor with the highest arbitration priority succeeds in issuing a NOP special cycle and is 
nominated the BSP. This processor sets the BSP flag in its IA32_APIC_BASE MSR, then fetches and 
begins executing BIOS boot-strap code, beginning at the reset vector (physical address FFFF FFFOH). 


The remaining logical processors (that failed in issuing a NOP special cycle) are designated as APs. They 
leave their BSP flags in the clear state and enter a “wait-for-SIPI state.” 


— Early generations of IA processors within family OFH (family=OFH, model=0H, stepping<=09H), P6 family 
or older processors supporting MP operations (family=06H, extended_model=0, model<=ODH; or family 
<06H): 
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Each processor broadcasts a BIPI to “all including self.” The first processor that broadcasts a BIPI (and 
thus receives its own BIPI vector), selects itself as the BSP and sets the BSP flag in its IA32_APIC_BASE 
MSR. (See Section 9.11.1, “Overview of the MP Initialization Process for P6 Family Processors,” for a 
description of the BIPI, FIPI, and SIPI messages.) 


The remainder of the processors (which were not selected as the BSP) are designated as APs. They 
leave their BSP flags in the clear state and enter a “wait-for-SIPI state.” 


The newly established BSP broadcasts an FIPI message to “all including self,” which the BSP and APs 
treat as an end of MP initialization signal. Only the processor with its BSP flag set responds to the FIPI 
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message. It responds by fetching and executing the BIOS boot-strap code, beginning at the reset 
vector (physical address FFFF FFFOH). 


5. As part of the boot-strap code, the BSP creates an ACPI table and/or an MP table and adds its initial APIC ID to 
these tables as appropriate. 


6. At the end of the boot-strap procedure, the BSP sets a processor counter to 1, then broadcasts a SIPI message 
to all the APs in the system. Here, the SIPI message contains a vector to the BIOS AP initialization code (at 
OOOVVOOOH, where VV is the vector contained in the SIPI message). 


7. The first action of the AP initialization code is to set up a race (among the APs) to a BIOS initialization 
semaphore. The first AP to the semaphore begins executing the initialization code. (See Section 9.4.4, “MP 
Initialization Example,” for semaphore implementation details.) As part of the AP initialization procedure, the 
AP adds its APIC ID number to the ACPI and/or MP tables as appropriate and increments the processor counter 
by 1. At the completion of the initialization procedure, the AP executes a CLI instruction and halts itself. 


8. When each of the APs has gained access to the semaphore and executed the AP initialization code, the BSP 
establishes a count for the number of processors connected to the system bus, completes executing the BIOS 
boot-strap code, and then begins executing operating-system boot-strap and start-up code. 


9. While the BSP is executing operating-system boot-strap and start-up code, the APs remain in the halted state. 
In this state they will respond only to INITs, NMIs, and SMIs. They will also respond to snoops and to assertions 
of the STPCLK# pin. 


The following section gives an example (with code) of the MP initialization protocol for of multiple processors oper- 
ating in an MP configuration. 


Chapter 2, “Model-Specific Registers (MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 4, describes how to program the LINT[0:1] pins of the processor’s local APICs after an MP config- 
uration has been completed. 


9.4.4 MP Initialization Example 


The following example illustrates the use of the MP initialization protocol used to initialize processors in an MP 
system after the BSP and APs have been established. The code runs on Intel 64 or IA-32 processors that use a 
protocol. This includes P6 Family processors, Pentium 4 processors, Intel Core Duo, Intel Core 2 Duo and Intel Xeon 
processors. 


The following constants and data definitions are used in the accompanying 
code examples. They are based on the addresses of the APIC registers defined in Table 11-1. 


ICR_LOW EQU OFEEO0300H 
SVR EQU OFEEOOOFOH 
APIC_ID EQU OFEEO0020H 
LVT3 EQU OFEEO0370H 
APIC_LENABLED €QU0100H 
BOOT_ID DD? 

COUNT EQU OOH 
VACANT EQU OOH 


9.4.4.1 Typical BSP Initialization Sequence 


After the BSP and APs have been selected (by means of a hardware protocol, see Section 9.4.3, “MP Initialization 
Protocol Algorithm for MP Systems”), the BSP begins executing BIOS boot-strap code (POST) at the normal IA-32 
architecture starting address (FFFF FFFOH). The boot-strap code typically performs the following operations: 


1. Initializes memory. 

2. Loads the microcode update into the processor. 
3. Initializes the MTRRs. 

4. Enables the caches. 
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10. 


11. 


12. 


13. 


14. 


15. 


Executes the CPUID instruction with a value of OH in the EAX register, then reads the EBX, ECX, and EDX 
registers to determine if the BSP is “GenuinelIntel.” 


Executes the CPUID instruction with a value of 1H in the EAX register, then saves the values in the EAX, ECX, 
and EDX registers in a system configuration space in RAM for use later. 


Loads start-up code for the AP to execute into a 4-KByte page in the lower 1 MByte of memory. 


Switches to protected mode and ensures that the APIC address space is mapped to the strong uncacheable 
(UC) memory type. 
Determine the BSP’s APIC ID from the local APIC ID register (default is 0), the code snippet below is an 


example that applies to logical processors in a system whose local APIC units operate in xAPIC mode that APIC 
registers are accessed using memory mapped interface: 


MOV ESI, APIC_ID; Address of local APIC ID register 

MOV EAX, [ESI]; 

AND EAX, OFFOOOOOOH; Zero out all other bits except APIC ID 
MOV BOOT_ID, EAX; Save in memory 


Saves the APIC ID in the ACPI and/or MP tables and optionally in the system configuration space in RAM. 


Converts the base address of the 4-KByte page for the AP’s bootup code into 8-bit vector. The 8-bit vector 
defines the address of a 4-KByte page in the real-address mode address space (1-MByte space). For example, 
a vector of OBDH specifies a start-up memory address of OOOBDOOOH. 


Enables the local APIC by setting bit 8 of the APIC spurious vector register (SVR). 


MOV ESI, SVR; Address of SVR 

MOV EAX, [ESI]; 

OR EAX, APIC_ENABLED; Set bit 8 to enable (0 on reset) 
MOV [ESI], EAX; 


Sets up the LVT error handling entry by establishing an 8-bit vector for the APIC error handler. 


MOV ESI, LVT3; 

MOV EAX, [ESI]; 

AND EAX, FFFFFFOOH; Clear out previous vector. 

OR EAX, OOOO000xxH; xx is the 8-bit vector the APIC error handler. 
MOV [ESI], EAX; 


Initializes the Lock Semaphore variable VACANT to OOH. The APs use this semaphore to determine the order in 
which they execute BIOS AP initialization code. 


Performs the following operation to set up the BSP to detect the presence of APs in the system and the number 
of processors (within a finite duration, minimally 100 milliseconds): 


— Sets the value of the COUNT variable to 1. 


— Inthe AP BIOS initialization code, the AP will increment the COUNT variable to indicate its presence. The 
finite duration while waiting for the COUNT to be updated can be accomplished with a timer. When the timer 
expires, the BSP checks the value of the COUNT variable. If the timer expires and the COUNT variable has 
not been incremented, no APs are present or some error has occurred. 


Broadcasts an INIT-SIPI-SIPI IPI sequence to the APs to wake them up and initialize them. Alternatively, 
following a power-up or RESET, since all APs are already in the “wait-for-SIPI state,” the BSP can broadcast just 
a single SIPI IPI to the APs to wake them up and initialize them. If software knows how many logical processors 
it expects to wake up, it may choose to poll the COUNT variable. If the expected processors show up before the 
100 millisecond timer expires, the timer can be canceled and skip to step 16. 


The left-hand-side of the procedure illustrated in Table 9-1 provides an algorithm when the expected processor 
count is unknown. The right-hand-side of Table 9-1 can be used when the expected processor count is known. 
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Table 9-1. Broadcast INIT-SIPI-SIPI Sequence and Choice of Timeouts 


INIT-SIPI-SIPI when the expected processor count is unknown 


INIT-SIPI-SIPI when the expected processor count is known 


MOV ESI, ICR_LOW; Load address of ICR low dword into ESI. 
MOV EAX, 000C4500H; Load ICR encoding for broadcast INIT IPI 
; to all APs into EAX. 

MOV [ESI], EAX; Broadcast INIT IPI to all APs 

; 10-millisecond delay loop. 

MOV EAX, OOOC46XXH; Load ICR encoding for broadcast SIPI IP 
; to all APs into EAX, where xx is the vector computed in step 10. 
MOV [ESI], EAX; Broadcast SIPI IPI to all APs 

; 200-microsecond delay loop 

MOV [ESI], EAX; Broadcast second SIPI IPI to all APs 

;Waits for the timer interrupt until the timer expires 


MOV ESI, ICR_LOW; Load address of ICR low dword into ESI. 
MOV EAX, O00C4500H; Load ICR encoding for broadcast INIT IPI 
; to all APs into EAX. 

MOV [ESI], EAX; Broadcast INIT IPI to all APs 

; 10-millisecond delay loop. 

MOV EAX, OOOC46XXH; Load ICR encoding for broadcast SIPI IP 
; to all APs into EAX, where xx is the vector computed in step 10. 
MOV [ESI], EAX; Broadcast SIPI IPI to all APs 

; 200 microsecond delay loop with check to see if COUNT has 

; reached the expected processor count. If COUNT reaches 

; expected processor count, cancel timer and go to step 16. 
MOV [ESI], EAX; Broadcast second SIPI IPI to all APs 

; Wait for the timer interrupt polling COUNT. If COUNT reaches 

; expected processor count, cancel timer and go to step 16. 

; If timer expires, go to step 16. 


16. Reads and evaluates the COUNT variable and establishes a processor count. 


17. If necessary, reconfigures the APIC and continues with the remaining system diagnostics as appropriate. 


9.4.4.2 Typical AP Initialization Sequence 


When an AP receives the SIPI, it begins executing BIOS AP initialization code at the vector encoded in the SIPI. The 
AP initialization code typically performs the following operations: 


1. Waits on the BIOS initialization Lock Semaphore. When control of the semaphore is attained, initialization 


continues. 


Loads the microcode update into the processor. 


Enables the cache. 


no BW N 


registers to determine if the AP is “GenuineIntel.” 


Initializes the MTRRs (using the same mapping that was used for the BSP). 


Executes the CPUID instruction with a value of OH in the EAX register, then reads the EBX, ECX, and EDX 


6. Executes the CPUID instruction with a value of 1H in the EAX register, then saves the values in the EAX, ECX, 
and EDX registers in a system configuration space in RAM for use later. 


7. Switches to protected mode and ensures that the APIC address space is mapped to the strong uncacheable 


(UC) memory type. 


8. Determines the AP’s APIC ID from the local APIC ID register, and adds it to the MP and ACPI tables and 


optionally to the system configuration space in RAM. 


9. Initializes and configures the local APIC by setting bit 8 in the SVR register and setting up the LVT3 (error LVT) 
for error handling (as described in steps 9 and 10 in Section 9.4.4.1, “Typical BSP Initialization Sequence”). 


. Increments the COUNT variable by 1. 
. Releases the semaphore. 
. Executes one of the following: 


. Configures the APs SMI execution environment. (Each AP and the BSP must have a different SMBASE address.) 
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— the CLI and HLT instructions (if MONITOR/MWAIT is not supported), or 
— the CLI, MONITOR, and MWAIT sequence to enter a deep C-state. 
14. Waits for an INIT IPI. 


9.4.5 Identifying Logical Processors in an MP System 


After the BIOS has completed the MP initialization protocol, each logical processor can be uniquely identified by its 
local APIC ID. Software can access these APIC IDs in either of the following ways: 


* Read APIC ID for a local APIC — Code running on a logical processor can read APIC ID in one of two ways 
depending on the local APIC unit is operating in x2APIC mode or in xAPIC mode: 


— If the local APIC unit supports x2APIC and is operating in x2APIC mode, 32-bit APIC ID can be read by 
executing a RDMSR instruction to read the processor’s x2APIC ID register. This method is equivalent to 
executing CPUID leaf OBH described below. 


— Ifthe local APIC unit is operating in xAPIC mode, 8-bit APIC ID can be read by executing a MOV instruction 
to read the processor’s local APIC ID register (see Section 11.4.6, “Local APIC ID”). This is the ID to use for 
directing physical destination mode interrupts to the processor. 


° Read ACPI or MP table — As part of the MP initialization protocol, the BIOS creates an ACPI table and an MP 
table. These tables are defined in the Multiprocessor Specification Version 1.4 and provide software with a list 
of the processors in the system and their local APIC IDs. The format of the ACPI table is derived from the ACPI 
specification, which is an industry standard power management and platform configuration specification for MP 
systems. 


* Read Initial APIC ID (If the processor does not support CPUID leaf OBH) — An APIC ID is assigned to a logical 
processor during power up. This is the initial APIC ID reported by CPUID.1:EBX[31:24] and may be different 
from the current value read from the local APIC. The initial APIC ID can be used to determine the topological 
relationship between logical processors for multi-processor systems that do not support CPUID leaf OBH. 


Bits in the 8-bit initial APIC ID can be interpreted using several bit masks. Each bit mask can be used to extract 
an identifier to represent a hierarchical domain of the multi-threading resource topology in an MP system (See 
Section 9.9.1, “Hierarchical Mapping of Shared Resources”). The initial APIC ID may consist of up to four bit- 
fields. In a non-clustered MP system, the field consists of up to three bit fields. 


* Read 32-bit APIC ID from CPUID leaf OBH (If the processor supports CPUID leaf OBH) — A unique APIC ID 
is assigned to a logical processor during power up. This APIC ID is reported by CPUID.OBH:EDX[31:0] as a 32- 
bit value. Use the 32-bit APIC ID and CPUID leaf OBH to determine the topological relationship between logical 
processors if the processor supports CPUID leaf OBH. 


Bits in the 32-bit x2APIC ID can be extracted into sub-fields using CPUID leaf OBH parameters. (See Section 
9.9.1, “Hierarchical Mapping of Shared Resources”). 


Figure 9-2 shows two examples of APIC ID bit fields in earlier single-core processors. In single-core Intel Xeon 
processors, the APIC ID assigned to a logical processor during power-up and initialization is 8 bits. Bits 2:1 forma 
2-bit physical package identifier (which can also be thought of as a socket identifier). In systems that configure 
physical processors in clusters, bits 4:3 form a 2-bit cluster ID. Bit 0 is used in the Intel Xeon processor MP to iden- 
tify the two logical processors within the package (see Section 9.9.3, “Hierarchical ID of Logical Processors in an MP 
System”). For Intel Xeon processors that do not support Intel Hyper-Threading Technology, bit 0 is always set to 0; 
for Intel Xeon processors supporting Intel Hyper-Threading Technology, bit 0 performs the same function as it does 
for Intel Xeon processor MP. 


For more recent multi-core processors, see Section 9.9.1, “Hierarchical Mapping of Shared Resources,” for a 
complete description of the topological relationships between logical processors and bit field locations within an 
initial APIC ID across Intel 64 and IA-32 processor families. 


Note the number of bit fields and the width of bit-fields are dependent on processor and platform hardware capa- 
bilities. Software should determine these at runtime. When initial APIC IDs are assigned to logical processors, the 
value of APIC ID assigned to a logical processor will respect the bit-field boundaries corresponding core, physical 
package, etc. Additional examples of the bit fields in the initial APIC ID of multi-threading capable systems are 
shown in Section 9.9. 
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APIC ID Format for Intel Xeon Processors that 
do not Support Intel Hyper-Threading Technology 


f 5 4 3 2 1 0 


Reserved | | 0 


Cluster | 


Processor ID 


APIC ID Format for P6 Family Processors 
7 4 3 2 1 ) 


Reserved | 


Cluster ————__! 
Processor ID 


Figure 9-2. Interpretation of APIC ID in Early MP Systems 


For P6 family processors, the APIC ID that is assigned to a processor during power-up and initialization is 4 bits 
(see Figure 9-2). Here, bits 0 and 1 form a 2-bit processor (or socket) identifier and bits 2 and 3 form a 2-bit cluster 
ID. 


9.5 INTEL® HYPER-THREADING TECHNOLOGY AND INTEL® MULTI-CORE 
TECHNOLOGY 


Intel Hyper-Threading Technology and Intel multi-core technology are extensions to Intel 64 and IA-32 architec- 
tures that enable a single physical processor to execute two or more separate code streams (called threads) 
concurrently. In Intel Hyper-Threading Technology, a single processor core provides two logical processors that 
share execution resources (see Section 9.7, “Intel® Hyper-Threading Technology Architecture”). In Intel multi- 
core technology, a physical processor package provides two or more processor cores. Both configurations require 
chipsets and a BIOS that support the technologies. 


Software should not rely on processor names to determine whether a processor supports Intel Hyper-Threading 
Technology or Intel multi-core technology. Use the CPUID instruction to determine processor capability (see 
Section 9.6.2, “Initializing Multi-Core Processors”). 


9.6 DETECTING HARDWARE MULTI-THREADING SUPPORT AND TOPOLOGY 


Use the CPUID instruction to detect the presence of hardware multi-threading support in a physical processor. 
Hardware multi-threading can support several varieties of multigrade and/or Intel Hyper-Threading Technology. 
CPUID instruction provides several sets of parameter information to aid software enumerating topology informa- 
tion. The relevant topology enumeration parameters provided by CPUID include: 


¢ Hardware Multi-Threading feature flag (CPUID.1:EDX[28] = 1) — Indicates when set that the physical 
package is capable of supporting Intel Hyper-Threading Technology and/or multiple cores. 
¢ Processor topology enumeration parameters for 8-bit APIC ID: 

— Addressable IDs for Logical processors in the same Package (CPUID.1:EBX[23:16]) — Indicates 
the maximum number of addressable ID for logical processors in a physical package. Within a physical 
package, there may be addressable IDs that are not occupied by any logical processors. This parameter 
does not represents the hardware capability of the physical processor.! 
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* Addressable IDs for processor cores in the same Package! (CPUID.(EAX=4, ECX=02):EAX[31:26] + 
1 = Y) — Indicates the maximum number of addressable IDs attributable to processor cores (Y) in the physical 
package. 


° Extended Processor Topology Enumeration parameters for 32-bit APIC ID: Intel 64 processors 
supporting CPUID leaf OBH will assign unique APIC IDs to each logical processor in the system. CPUID leaf OBH 
reports the 32-bit APIC ID and provide topology enumeration parameters. See CPUID instruction reference 
pages in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. 


The CPUID feature flag may indicate support for hardware multi-threading when only one logical processor avail- 
able in the package. In this case, the decimal value represented by bits 16 through 23 in the EBX register will have 
a value of 1. 


Software should note that the number of logical processors enabled by system software may be less than the value 
of “Addressable IDs for Logical processors”. Similarly, the number of cores enabled by system software may be less 
than the value of “Addressable IDs for processor cores”. 


Software can detect the availability of the CPUID extended topology enumeration leaf (OBH) by performing two 
steps: 


¢ Check maximum input value for basic CPUID information by executing CPUID with EAX= 0. If CPUID.OH:EAX is 
greater than or equal or 11 (OBH), then proceed to next step, 


® Check CPUID.EAX=0BH, ECX=0H:EBxX is non-zero. 


If both of the above conditions are true, extended topology enumeration leaf is available. Note the presence of 
CPUID leaf OBH in a processor does not guarantee support that the local APIC supports x2APIC. If 
CPUID.(EAX=0BH, ECX=0H):EBX returns zero and maximum input value for basic CPUID information is greater 
than OBH, then CPUID.OBH leaf is not supported on that processor. 


9.6.1 Initializing Processors Supporting Intel® Hyper-Threading Technology 


The initialization process for an MP system that contains processors supporting Intel Hyper-Threading Technology 
is the same as for conventional MP systems (see Section 9.4, “Multiple-Processor (MP) Initialization”). One logical 
processor in the system is selected as the BSP and other processors (or logical processors) are designated as APs. 
The initialization process is identical to that described in Section 9.4.3, “MP Initialization Protocol Algorithm for MP 
Systems,” and Section 9.4.4, “MP Initialization Example.” 


During initialization, each logical processor is assigned an APIC ID that is stored in the local APIC ID register for 
each logical processor. If two or more processors supporting Intel Hyper-Threading Technology are present, each 
logical processor on the system bus is assigned a unique ID (see Section 9.9.3, “Hierarchical ID of Logical Proces- 
sors in an MP System”). Once logical processors have APIC IDs, software communicates with them by sending APIC 
IPI messages. 


9.6.2 Initializing Multi-Core Processors 


The initialization process for an MP system that contains multi-core Intel 64 or IA-32 processors is the same as for 
conventional MP systems (see Section 9.4, “Multiple-Processor (MP) Initialization”). A logical processor in one core 
is selected as the BSP; other logical processors are designated as APs. 


During initialization, each logical processor is assigned an APIC ID. Once logical processors have APIC IDs, software 
may communicate with them by sending APIC IPI messages. 


1. Operating system and BIOS may implement features that reduce the number of logical processors available in a platform to applica- 
tions at runtime to less than the number of physical packages times the number of hardware-capable logical processors per package. 


1. Software must check CPUID for its support of leaf 4 when implementing support for multi-core. If CPUID leaf 4 is not available at run- 
time, software should handle the situation as if there is only one core per package. 


2. Maximum number of cores in the physical package must be queried by executing CPUID with EAX=4 and a valid ECX input value. 
Valid ECX input values start from 0. 
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9.6.3 Executing Multiple Threads on an Intel® 64 or IA-32 Processor Supporting Hardware 
Multi-Threading 


Upon completing the operating system boot-up procedure, the bootstrap processor (BSP) executes operating 
system code. Other logical processors are placed in the halt state. To execute a code stream (thread) on a halted 
logical processor, the operating system issues an interprocessor interrupt (IPI) addressed to the halted logical 
processor. In response to the IPI, the processor wakes up and begins executing the code identified by the vector 
received as part of the IPI. 


To manage execution of multiple threads on logical processors, an operating system can use conventional 
symmetric multiprocessing (SMP) techniques. For example, the operating-system can use a time-slice or load 
balancing mechanism to periodically interrupt each of the active logical processors. Upon interrupting a logical 
processor, the operating system checks its run queue for a thread waiting to be executed and dispatches the thread 
to the interrupted logical processor. 


9.6.4 Handling Interrupts on an IA-32 Processor Supporting Hardware Multi-Threading 


Interrupts are handled on processors supporting Intel Hyper-Threading Technology as they are on conventional MP 
systems. External interrupts are received by the I/O APIC, which distributes them as interrupt messages to specific 
logical processors (see Figure 9-3). 


Logical processors can also send IPIs to other logical processors by writing to the ICR register of its local APIC (see 
Section 11.6, “Issuing Interprocessor Interrupts”). This also applies to dual-core processors. 


Intel Processor with Intel Intel Processor with Intel 
Hyper-Threading Technology Hyper-Threading Technology 


Logical Logical Logical Logical 
Processor 0 | Processor 1 Processor 0 | Processor 1 
Processor Core Processor Core 


Local APIC | Local APIC Local APIC | Local APIC 


Bus Interface Bus Interface 
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pt Interrupt 
rs Messages da Messages 
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Bridge 
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~<—_ External 
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System Chipset 


Figure 9-3. Local APICs and I/O APIC in MP System Supporting Intel HT Technology 


9.7 INTEL® HYPER-THREADING TECHNOLOGY ARCHITECTURE 


Figure 9-4 shows a generalized view of an Intel processor supporting Intel Hyper-Threading Technology, using the 
original Intel Xeon processor MP as an example. This implementation of the Intel Hyper-Threading Technology 
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consists of two logical processors (each represented by a separate architectural state) which share the processor's 
execution engine and the bus interface. Each logical processor also has its own advanced programmable interrupt 
controller (APIC). 


Logical Logical 
Processor 0 | Processor 1 
Architectural | Architectural 

State State 


Execution Engine 


Local APIC | Local APIC 
Bus Interface 


<]_—__—_——_ > 


System Bus 


Figure 9-4, IA-32 Processor with Two Logical Processors Supporting Intel HT Technology 


9.7.1 State of the Logical Processors 


The following features are part of the architectural state of logical processors within Intel 64 or IA-32 processors 
supporting Intel Hyper-Threading Technology. The features can be subdivided into three groups: 


® Duplicated for each logical processor 

¢ Shared by logical processors in a physical processor 

¢ Shared or duplicated, depending on the implementation 

The following features are duplicated for each logical processor: 

* General purpose registers (EAX, EBX, ECX, EDX, ESI, EDI, ESP, and EBP) 
° Segment registers (CS, DS, SS, ES, FS, and GS) 


¢ EFLAGS and EIP registers. Note that the CS and EIP/RIP registers for each logical processor point to the 
instruction stream for the thread being executed by the logical processor. 


° x87 FPU registers (STO through ST7, status word, control word, tag word, data operand pointer, and instruction 
pointer) 


° MMxX registers (MMO through MM7) 

¢ XMM registers (XMMO through XMM7) and the MXCSR register 

* Control registers and system table pointer registers (GDTR, LDTR, IDTR, task register) 

* Debug registers (DRO, DR1, DR2, DR3, DR6, DR7) and the debug control MSRs 

® Machine check global status (IA32_MCG_STATUS) and machine check capability (IA32_MCG_CAP) MSRs 
¢ Thermal clock modulation and ACPI Power management control MSRs 

° Time stamp counter MSRs 

° Most of the other MSR registers, including the page attribute table (PAT). See the exceptions below. 

¢ Local APIC registers. 


e Additional general purpose registers (R8-R15), XMM registers (XMM8-XMM15), control register, IA32_EFER on 
Intel 64 processors. 


The following features are shared by logical processors: 
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¢ Memory type range registers (MTRRs) 

Whether the following features are shared or duplicated is implementation-specific: 

e TA32_MISC_ENABLE MSR (MSR address 1A0H) 

¢ Machine check architecture (MCA) MSRs (except for the IA32_MCG_STATUS and IA32_MCG_CAP MSRs) 
¢ Performance monitoring control and counter MSRs 


S72 APIC Functionality 


When a processor supporting Intel Hyper-Threading Technology support is initialized, each logical processor is 
assigned a local APIC ID (see Table 11-1). The local APIC ID serves as an ID for the logical processor and is stored 
in the logical processor’s APIC ID register. If two or more processors supporting Intel Hyper-Threading Technology 
are present in a dual processor (DP) or MP system, each logical processor on the system bus is assigned a unique 
local APIC ID (see Section 9.9.3, “Hierarchical ID of Logical Processors in an MP System”). 


Software communicates with local processors using the APIC’s interprocessor interrupt (IPI) messaging facility. 
Setup and programming for APICs is identical in processors that support and do not support Intel Hyper-Threading 
Technology. See Chapter 11, “Advanced Programmable Interrupt Controller (APIC),” for a detailed discussion. 


9.7.3 Memory Type Range Registers (MTRR) 


MTRRs in a processor supporting Intel Hyper-Threading Technology are shared by logical processors. When one 
logical processor updates the setting of the MTRRs, settings are automatically shared with the other logical proces- 
sors in the same physical package. 


The architectures require that all MP systems based on Intel 64 and IA-32 processors (this includes logical proces- 
sors) must use an identical MTRR memory map. This gives software a consistent view of memory, independent of 
the processor on which it is running. See Section 12.11, ‘Memory Type Range Registers (MTRRs),” for information 
on setting up MTRRs. 


9.7.4 Page Attribute Table (PAT) 


Each logical processor has its own PAT MSR (IA32_PAT). However, as described in Section 12.12, “Page Attribute 
Table (PAT),” the PAT MSR settings must be the same for all processors in a system, including the logical proces- 
sors. 


9.7.5 Machine Check Architecture 


In the Intel HT Technology context as implemented by processors based on Intel NetBurst® microarchitecture, all 
of the machine check architecture (MCA) MSRs (except for the IA32_MCG_STATUS and IA32_MCG_CAP MSRs) are 
duplicated for each logical processor. This permits logical processors to initialize, configure, query, and handle 
machine-check exceptions simultaneously within the same physical processor. The design is compatible with 
machine check exception handlers that follow the guidelines given in Chapter 16, “Machine-Check Architecture.” 


The IA32_MCG_STATUS MSR is duplicated for each logical processor so that its machine check in progress bit field 
(MCIP) can be used to detect recursion on the part of MCA handlers. In addition, the MSR allows each logical 
processor to determine that a machine-check exception is in progress independent of the actions of another logical 
processor in the same physical package. 


Because the logical processors within a physical package are tightly coupled with respect to shared hardware 
resources, both logical processors are notified of machine check errors that occur within a given physical processor. 
If machine-check exceptions are enabled when a fatal error is reported, all the logical processors within a physical 
package are dispatched to the machine-check exception handler. If machine-check exceptions are disabled, the 
logical processors enter the shutdown state and assert the IERR# signal. 


When enabling machine-check exceptions, the MCE flag in control register CR4 should be set for each logical 
processor. 
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On Intel Atom family processors that support Intel Hyper-Threading Technology, the MCA facilities are shared 
between all logical processors on the same processor core. 


9.7.6 Debug Registers and Extensions 


Each logical processor has its own set of debug registers (DRO, DR1, DR2, DR3, DR6, DR7) and its own debug 
control MSR. These can be set to control and record debug information for each logical processor independently. 
Each logical processor also has its own last branch records (LBR) stack. 


9.7.7 Performance Monitoring Counters 


Performance counters and their companion control MSRs are shared between the logical processors within a 
processor core for processors based on Intel NetBurst microarchitecture. As a result, software must manage the 
use of these resources. The performance counter interrupts, events, and precise event monitoring support can be 
set up and allocated on a per thread (per logical processor) basis. 


See Section 20.6.4, “Performance Monitoring and Intel® Hyper-Threading Technology in Processors Based on Intel 
NetBurst® Microarchitecture,” for a discussion of performance monitoring in the Intel Xeon processor MP. 


In Intel Atom processor family that support Intel Hyper-Threading Technology, the performance counters (general- 
purpose and fixed-function counters) and their companion control MSRs are duplicated for each logical processor. 


9.7.8 IA32_MISC_ENABLE MSR 


The IA32_MISC_ENABLE MSR (MSR address 1A0H) is generally shared between the logical processors in a 
processor core supporting Intel Hyper-Threading Technology. However, some bit fields within IA32_MISC_ENABLE 
MSR may be duplicated per logical processor. The partition of shared or duplicated bit fields within IA32_MISC_EN- 
ABLE is implementation dependent. Software should program duplicated fields carefully on all logical processors in 
the system to ensure consistent behavior. 


9.7.9 Memory Ordering 


The logical processors in an Intel 64 or IA-32 processor supporting Intel Hyper-Threading Technology obey the 
same rules for memory ordering as Intel 64 or IA-32 processors without Intel HT Technology (see Section 9.2, 
“Memory Ordering”). Each logical processor uses a processor-ordered memory model that can be further defined 
as “write-ordered with store buffer forwarding.” All mechanisms for strengthening or weakening the memory- 
ordering model to handle special programming situations apply to each logical processor. 


9.7.10  Serializing Instructions 


As a general rule, when a logical processor in a processor supporting Intel Hyper-Threading Technology executes a 
serializing instruction, only that logical processor is affected by the operation. An exception to this rule is the execu- 
tion of the WBINVD, INVD, and WRMSR instructions; and the MOV CR instruction when the state of the CD flag in 

control register CRO is modified. Here, both logical processors are serialized. 


9.7.11 Microcode Update Resources 


In an Intel processor supporting Intel Hyper-Threading Technology, the microcode update facilities are shared 
between the logical processors; either logical processor can initiate an update. Each logical processor has its own 
BIOS signature MSR (IA32_BIOS_SIGN_ID at MSR address 8BH). When a logical processor performs an update for 
the physical processor, the IA32_BIOS_SIGN_ID MSRs for resident logical processors are updated with identical 
information. If logical processors initiate an update simultaneously, the processor core provides the necessary 
synchronization needed to ensure that only one update is performed at a time. 
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NOTE 


Some processors (prior to the introduction of Intel 64 Architecture and based on Intel NetBurst 
microarchitecture) do not support simultaneous loading of microcode update to the sibling logical 
processors in the same core. All other processors support logical processors initiating an update 
simultaneously. Intel recommends a common approach that the microcode loader use the 
sequential technique described in Section 10.11.6.3. 


9.7.12 Self Modifying Code 


Intel processors supporting Intel Hyper-Threading Technology support self-modifying code, where data writes 
modify instructions cached or currently in flight. They also support cross-modifying code, where on an MP system 
writes generated by one processor modify instructions cached or currently in flight on another. See Section 9.1.3, 
“Handling Self- and Cross-Modifying Code,” for a description of the requirements for self- and cross-modifying code 
in an IA-32 processor. 


9.7.13. Implementation-Specific Intel? HT Technology Facilities 


The following non-architectural facilities are implementation-specific in IA-32 processors supporting Intel Hyper- 
Threading Technology: 


° Caches. 
¢ Translation lookaside buffers (TLBs). 
¢ Thermal monitoring facilities. 


The Intel Xeon processor MP implementation is described in the following sections. 


9.7.13.1 Processor Caches 


For processors supporting Intel Hyper-Threading Technology, the caches are shared. Any cache manipulation 
instruction that is executed on one logical processor has a global effect on the cache hierarchy of the physical 
processor. Note the following: 


¢ WBINVD instruction — The entire cache hierarchy is invalidated after modified data is written back to 
memory. All logical processors are stopped from executing until after the write-back and invalidate operation is 
completed. A special bus cycle is sent to all caching agents. The amount of time or cycles for WBINVD to 
complete will vary due to the size of different cache hierarchies and other factors. As a consequence, the use of 
the WBINVD instruction can have an impact on interrupt/event response time. 


¢ INVD instruction — The entire cache hierarchy is invalidated without writing back modified data to memory. 
All logical processors are stopped from executing until after the invalidate operation is completed. A special bus 
cycle is sent to all caching agents. 


¢ CLFLUSH and CLFLUSHOPT instructions — The specified cache line is invalidated from the cache hierarchy 
after any modified data is written back to memory and a bus cycle is sent to all caching agents, regardless of 
which logical processor caused the cache line to be filled. 


¢ CD flag in control register CRO — Each logical processor has its own CRO control register, and thus its own 
CD flag in CRO. The CD flags for the two logical processors are ORed together, such that when any logical 
processor sets its CD flag, the entire cache is nominally disabled. 


9.7.13.2 Processor Translation Lookaside Buffers (TLBs) 


In processors supporting Intel Hyper-Threading Technology, data cache TLBs are shared. The instruction cache TLB 
may be duplicated or shared in each logical processor, depending on implementation specifics of different 
processor families. 


Entries in the TLBs are tagged with an ID that indicates the logical processor that initiated the translation. This tag 
applies even for translations that are marked global using the page-global feature for memory paging. See Section 
4.10, “Caching Translation Information,” for information about global translations. 
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When a logical processor performs a TLB invalidation operation, only the TLB entries that are tagged for that logical 
processor are guaranteed to be flushed. This protocol applies to all TLB invalidation operations, including writes to 
control registers CR3 and CR4 and uses of the INVLPG instruction. 


9.7.13.3. Thermal Monitor 


In a processor that supports Intel Hyper-Threading Technology, logical processors share the catastrophic shutdown 
detector and the automatic thermal monitoring mechanism (see Section 15.8, “Thermal Monitoring and Protec- 
tion”). Sharing results in the following behavior: 


e If the processor’s core temperature rises above the preset catastrophic shutdown temperature, the processor 
core halts execution, which causes both logical processors to stop execution. 


¢ When the processor’s core temperature rises above the preset automatic thermal monitor trip temperature, the 
frequency of the processor core is automatically modulated, which effects the execution speed of both logical 
processors. 


For software controlled clock modulation, each logical processor has its own IA32_CLOCK_MODULATION MSR, 
allowing clock modulation to be enabled or disabled on a logical processor basis. Typically, if software controlled 
clock modulation is going to be used, the feature must be enabled for all the logical processors within a physical 
processor and the modulation duty cycle must be set to the same value for each logical processor. If the duty cycle 
values differ between the logical processors, the processor clock will be modulated at the highest duty cycle 
selected. 


9.7.13.4 External Signal Compatibility 


This section describes the constraints on external signals received through the pins of a processor supporting Intel 
Hyper-Threading Technology and how these signals are shared between its logical processors. 


° STPCLK# — A single STPCLK# pin is provided on the physical package of the Intel Xeon processor MP. External 
control logic uses this pin for power management within the system. When the STPCLK# signal is asserted, the 
processor core transitions to the stop-grant state, where instruction execution is halted but the processor core 
continues to respond to snoop transactions. Regardless of whether the logical processors are active or halted 
when the STPCLK# signal is asserted, execution is stopped on both logical processors and neither will respond 
to interrupts. 


In MP systems, the STPCLK# pins on all physical processors are generally tied together. As a result this signal 
affects all the logical processors within the system simultaneously. 


¢ LINTO and LINT1 pins — A processor supporting Intel Hyper-Threading Technology has only one set of LINTO 
and LINT1 pins, which are shared between the logical processors. When one of these pins is asserted, both 
logical processors respond unless the pin has been masked in the APIC local vector tables for one or both of the 
logical processors. 


Typically in MP systems, the LINTO and LINT1 pins are not used to deliver interrupts to the logical processors. 
Instead all interrupts are delivered to the local processors through the I/O APIC. 


* A20M# pin — On an IA-32 processor, the A20M# pin is typically provided for compatibility with the Intel 286 
processor. Asserting this pin causes bit 20 of the physical address to be masked (forced to zero) for all external 
bus memory accesses. Processors supporting Intel Hyper-Threading Technology provide one A20M# pin, which 
affects the operation of both logical processors within the physical processor. 


The functionality of AZ0M# is used primarily by older operating systems and not used by modern operating 
systems. On newer Intel 64 processors, A20M# may be absent. 


9.8 MULTI-CORE ARCHITECTURE 


This section describes the architecture of Intel 64 and IA-32 processors supporting dual-core and quad-core tech- 
nology. The discussion is applicable to the Intel Pentium processor Extreme Edition, Pentium D, Intel Core Duo, 
Intel Core 2 Duo, Dual-core Intel Xeon processor, Intel Core 2 Quad processors, and quad-core Intel Xeon proces- 
sors. Features vary across different microarchitectures and are detectable using CPUID. 
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In general, each processor core has dedicated microarchitectural resources identical to a single-processor imple- 
mentation of the underlying microarchitecture without hardware multi-threading capability. Each logical processor 
in a dual-core processor (whether supporting Intel Hyper-Threading Technology or not) has its own APIC function- 
ality, PAT, machine check architecture, debug registers and extensions. Each logical processor handles serialization 
instructions or self-modifying code on its own. Memory order is handled the same way as in Intel Hyper-Threading 
Technology. 


The topology of the cache hierarchy (with respect to whether a given cache level is shared by one or more 
processor cores or by all logical processors in the physical package) depends on the processor implementation. 
Software must use the deterministic cache parameter leaf of CPUID instruction to discover the cache-sharing 
topology between the logical processors in a multi-threading environment. 


9.8.1 Logical Processor Support 


The topological composition of processor cores and logical processors in a multi-core processor can be discovered 
using CPUID. Within each processor core, one or more logical processors may be available. 


System software must follow the requirement MP initialization sequences (see Section 9.4, “Multiple-Processor 
(MP) Initialization”) to recognize and enable logical processors. At runtime, software can enumerate those logical 
processors enabled by system software to identify the topological relationships between these logical processors. 
(See Section 9.9.5, “Identifying Topological Relationships in an MP System”). 


9.8.2 Memory Type Range Registers (MTRR) 


MTRR is shared between two logical processors sharing a processor core if the physical processor supports Intel 
Hyper-Threading Technology. MTRR is not shared between logical processors located in different cores or different 
physical packages. 


The Intel 64 and IA-32 architectures require that all logical processors in an MP system use an identical MTRR 
memory map. This gives software a consistent view of memory, independent of the processor on which it is 
running. 


See Section 12.11, “Memory Type Range Registers (MTRRs).” 


9.8.3 Performance Monitoring Counters 


Performance counters and their companion control MSRs are shared between two logical processors sharing a 
processor core if the processor core supports Intel Hyper-Threading Technology and is based on Intel NetBurst 
microarchitecture. They are not shared between logical processors in different cores or different physical packages. 
As a result, software must manage the use of these resources, based on the topology of performance monitoring 
resources. Performance counter interrupts, events, and precise event monitoring support can be set up and allo- 
cated on a per thread (per logical processor) basis. 


See Section 20.6.4, “Performance Monitoring and Intel® Hyper-Threading Technology in Processors Based on Intel 
NetBurst® Microarchitecture.” 


9.8.4 IA32_MISC_ENABLE MSR 


Some bit fields in IA32_MISC_ENABLE MSR (MSR address 1A0H) may be shared between two logical processors 
sharing a processor core, or may be shared between different cores in a physical processor. See Chapter 2, “Model- 
Specific Registers (MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4. 


9.8.5 Microcode Update Resources 


Microcode update facilities are shared between two logical processors sharing a processor core if the physical 
package supports Intel Hyper-Threading Technology. They are not shared between logical processors in different 
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cores or different physical packages. Either logical processor that has access to the microcode update facility can 
initiate an update. 


Each logical processor has its own BIOS signature MSR (IA32_BIOS_SIGN_ID at MSR address 8BH). When a logical 
processor performs an update for the physical processor, the IA32_BIOS_SIGN_ID MSRs for resident logical 
processors are updated with identical information. 


All microcode update steps during processor initialization should use the same update data on all cores in all phys- 
ical packages of the same stepping. Any subsequent microcode update must apply consistent update data to all 
cores in all physical packages of the same stepping. If the processor detects an attempt to load an older microcode 
update when a newer microcode update had previously been loaded, it may reject the older update to stay with the 
newer update. 


NOTE 


Some processors (prior to the introduction of Intel 64 Architecture and based on Intel NetBurst 
microarchitecture) do not support simultaneous loading of microcode update to the sibling logical 
processors in the same core. All other processors support logical processors initiating an update 
simultaneously. Intel recommends a common approach that the microcode loader use the 
sequential technique described in Section 10.11.6.3. 


34 PROGRAMMING CONSIDERATIONS FOR HARDWARE MULTI-THREADING 
CAPABLE PROCESSORS 


In a multi-threading environment, there may be certain hardware resources that are physically shared at some 
level of the hardware topology. In the multi-processor systems, typically bus and memory sub-systems are physi- 
cally shared between multiple sockets. Within a hardware multi-threading capable processors, certain resources 
are provided for each processor core, while other resources may be provided for each logical processors (see 
Section 9.7, “Intel® Hyper-Threading Technology Architecture,” and Section 9.8, “Multi-Core Architecture”). 


From a software programming perspective, control transfer of processor operation is managed at the granularity of 
logical processor (operating systems dispatch a runnable task by allocating an available logical processor on the 
platform). To manage the topology of shared resources in a multi-threading environment, it may be useful for soft- 
ware to understand and manage resources that are shared by more than one logical processors. 


9.9.1 Hierarchical Mapping of Shared Resources 


The APIC_ID value associated with each logical processor in a multi-processor system is unique (see Section 9.6, 
“Detecting Hardware Multi-Threading Support and Topology”). This 8-bit or 32-bit value can be decomposed into 
sub-fields, where each sub-field corresponds a hierarchical domain of the topological mapping of hardware 
resources. 


The decomposition of an APIC_ID may consist of several sub fields representing the topology within a physical 
processor package, the higher-order bits of an APIC ID may also be used by cluster vendors to represent the 
topology of cluster nodes of each coherent multiprocessor systems: 


¢ Cluster — Some multi-threading environments consists of multiple clusters of multi-processor systems. The 
CLUSTER_ID sub-field is usually supported by vendor firmware to distinguish different clusters. For non- 
clustered systems, CLUSTER_ID is usually 0 and system topology is reduced. 


¢ Package — A physical processor package mates with a socket. A package may contain one or more software 
visible die. The PACKAGE_ID sub-field distinguishes different physical packages within a cluster. 


* Die — A software-visible chip inside a package. The DIE_ID sub-field distinguishes different die within a 
package. If there are no software visible die, the width of this bit field is 0. 


* DieGrp — A group of die that share certain resources. 


° Tile — A set of cores that share certain resources. The TILE_ID sub-field distinguishes different tiles. If there 
are no software visible tiles, the width of this bit field is 0. 
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¢ Module — A set of cores that share certain resources. The MODULE_ID sub-field distinguishes different 
modules. If there are no software visible modules, the width of this bit field is 0. 


* Core — Processor cores may be contained within modules, within tiles, on software-visible die, or appear 
directly at the package domain. The CORE_ID sub-field distinguishes processor cores. For a single-core 
processor, the width of this bit field is 0. 


¢ Logical Processor — A processor core provides one or more logical processors sharing execution resources. 
The LOGICAL_PROCESSOR_ID sub-field distinguishes logical processors in a core. The width of this bit field is 
non-zero if a processor core provides more than one logical processors. 


The LOGICAL_PROCESSOR_ID and CORE_ID sub-fields are bit-wise contiguous in the APIC_ID field (see 
Figure 9-5). 


Reserved 


CLUSTER_ID | 


PACKAGE_ID 
DIE_ID 

TILE_ID 

MODULE_ID 

CORE_ID 
LOGICAL_PROCESSOR_ID 


X=31 if x2APIC is supported, otherwise X= 7 


Figure 9-5. Generalized Seven-Domain Interpretation of the APIC ID 


If the processor supports CPUID leaf OBH and leaf 1FH, the 32-bit APIC ID can represent cluster plus several 
domains of topology within the physical processor package. The exact number of hierarchical domains within a 
physical processor package must be enumerated through CPUID leaf OBH and leaf 1FH. Common processor fami- 
lies may employ a topology similar to that represented by the 8-bit Initial APIC ID. In general, CPUID leaf OBH and 
leaf 1FH can support a topology enumeration algorithm that decompose a 32-bit APIC ID into more than four sub- 
fields (see Figure 9-6). 


NOTE 


CPUID leaf OBH and leaf 1FH can have differences in the number of domain types reported (CPUID 
leaf 1FH defines additional domain types). If the processor supports CPUID leaf 1FH, usage of this 
leaf is preferred over leaf OBH. CPUID leaf OBH is available for legacy compatibility going forward. 


The width of each sub-field depends on hardware and software configurations. Field widths can be determined at 
runtime using the algorithm discussed below (Example 9-16 through Example 9-21). 


Figure 7-6 depicts the relationships of three of the hierarchical sub-fields in a hypothetical MP system. The value of 
valid APIC_IDs need not be contiguous across package boundary or core boundaries. 
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PACKAGE 31 F 
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R 
CORE Reserved 
LOGICAL 
PROCESSOR 

CLUSTER_ID —— 

PACKAGE_ID 

Q_ID 

R_ID 

Physical Processor Topology CORE_ID 


LOGICAL_PROCESSOR_ID 


32-bit APIC ID Composition 


Figure 9-6. Conceptual Six-Domain Topology and 32-bit APIC ID Composition 


9.9.2 Hierarchical Mapping of CPUID Extended Topology Leaf 


CPUID leaf OBH and leaf 1FH provide enumeration parameters for software to identify each hierarchy of the 
processor topology in a deterministic manner. Each hierarchical domain of the topology starting from the Logical 
Processor domain is represented numerically by a sub-leaf index within the CPUID OBH leaf and 1FH leaf. Each 
domain of the topology is mapped to a sub-field in the APIC ID, following the general relationship depicted in 
Figure 9-6. This mechanism allows software to query the exact number of domains within a physical processor 
package and the bit-width of each sub-field of x2APIC ID directly. For example, 

° Starting from sub-leaf index 0 and incrementing ECX until CPUID.(EAX=OBH or 1FH, ECX=N):ECX[15:8] 
returns an invalid “domain type” encoding. The number of domains within the physical processor package is “N” 
(excluding PACKAGE). Using Figure 9-6 as an example, CPUID.(EAX=OBH or 1FH, ECX=4):ECX[15:8] will 
report 00H, indicating sub leaf 04H is invalid. This is also depicted by a pseudo code example: 


Example 9-16. Number of Domains Below the Physical Processor Package 


Word NumberOfDomainsBelowPackage = 0; 
DWord Subleaf = 0; 


EAX = OBH or 1FH; // query each sub leaf of CPUID leaf OBH or 1FH; CPUID leaf 1FH is preferred over leaf OBH if available. 
ECX = Subleaf; 
CPUID; 
while(EBX != 0) // Enumerate until EBX reports 0 
{ 

if(EAX[4:0] != 0) // A Shift Value of O indicates this domain does not exist. 

// (Such as no SMT_ID, which is required entry at sub-leaf 0.) 
{ 


NumberOfDomainsBelowPackagett+; 

} 

Subleaf++; 

EAX = OBH or 1FH; 

ECX = Subleaf; 

CPUID; 
} 
// NumberOfDomainsBelowPackage contains the absolute number of domains that exist below package. 
N = Subleaf; // Sub-leaf supplies the number of entries CPUID will return. 
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°  Sub-leaf index 0 (ECX= 0 as input) provides enumeration parameters to extract the LOGICAL_PROCESSOR_ID 
sub-field of x2APIC ID. If EAX = OBH or 1FH, and ECX =0 is specified as input when executing CPUID, 
CPUID.(EAX=OBH or 1FH, ECX=0):EAX[4:0] reports a value (a right-shift count) that allow software to extract 
part of x2APIC ID to distinguish the next higher topological entities above the LOGICAL_PROCESSOR_ID 
domain. This value also corresponds to the bit-width of the sub-field of x2APIC ID corresponding the hierar- 
chical domain with sub-leaf index 0. 


¢ For each subsequent higher sub-leaf index m, CPUID.(EAX=0BH or 1FH, ECX=m):EAX[4:0] reports the right- 
shift count that will allow software to extract part of x2APIC ID to distinguish higher-domain topological 
entities. This means the right-shift value at of sub-leaf m, corresponds to the least significant (m+1) sub-fields 
of the 32-bit x2APIC ID. 


Example 9-17. Bitwidth Determination of x2APIC ID Sub-fields 


For m=0,m<N,m ++; 
{ cumulative_width[m] = CPUID.(EAX=OBH or 1FH, ECX= m): EAX[4:0]; } 
BitWidth[O] = cumulative_width[O}]; 
Form=1,m<N,m++; 
BitWidth[m] = cumulative_width[m] - cumulative_width[m-1]; 


NOTE 


CPUID leaf 1FH is a preferred superset to leaf OBH. Leaf 1FH defines additional domain types, and 
it must be parsed by an algorithm that can handle the addition of future domain types. 


Previously, only the following encoding of hierarchical domain types were defined: 0 (invalid), 1 (logical processor), 
and 2 (core). With the additional hierarchical domain types available (see Section 9.9.1, “Hierarchical Mapping of 
Shared Resources,” and Figure 9-5, “Generalized Seven-Domain Interpretation of the APIC ID” ) software must not 
assume any “domain type” encoding value to be related to any sub-leaf index, except sub-leaf 0. 


Example 9-18. Support Routines for Identifying Package, Die, Core, and Logical Processors from 32-bit x2APIC ID 


a. Derive the extraction bitmask for logical processors in a processor core and associated mask offset for different 
cores. 
// 


// This example shows how to enumerate CPU topology domain types (domain types may or may not be known/supported by the 
software) 

// 

// Below is the list of sample domain types used in the example. 

// Refer to the CPUID Leaf 1FH definition for the actual domain type numbers: “V2 Extended Topology Enumeration Leaf (Initial EAX 
Value = 1FH)". 

// 

// LOGICAL PROCESSOR 

/1 CORE 

// MODULE 

// TILE 

// DIE 

// PACKAGE 

// 

// The example shows how to identify and derive the extraction bitmask for the domains with identify type 
LOGICAL_PROCESSOR_ID/CORE_ID/DIE_ID/PACKAGE_ID 

// 


int DeriveLogical_Processor_Mask_Offsets (void) 


{ 
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IF (\HWMTSupported()) return -1; 

execute cpuid with EAX = OBH or 1FH, ECX = 0; 

IF (returned domain type encoding in EXC[15:8] does not match LOGICAL_PROCESSOR_ID) return -1; 

Mask_Logical_Processor_shift = EAX[4:0]; //# bits shift right of APIC ID to distinguish different cores, note this can be a shift 
// of zero if there is only one logical processor per core. 

Logical Processor Mask =~( (-1) << Mask_Logical_Processor_shift); //shift left to derive extraction bitmask for 

// LOGICAL_PROCESSOR_ID 
return O; 


b. Derive the extraction bitmask for processor cores in a physical processor package and associated mask offset for 


different packages. 


int DeriveCore_Mask_Offsets (void) 


{ 
IF (\HWMTSupported()) return -1; 
execute cpuid with EAX = OBH or 1FH, ECX = 0; 
WHILE( ECX[15:8] ) { //domain type encoding is valid 
Mask_last_known_shift = EAX[4:0] 
IF (returned domain type encoding in ECX[15:8] matches CORE) { 
Mask_Core_shift = EAX[4:0]; 
} 
ELSE IF (returned domain type encoding in ECX[15:8] matches DIE { 
Mask_Die_shift = EAX[4:0]; 
} 
// 
// Keep enumerating. Check if the next domain is the desired domain and if not, keep enumerating until you reach a known 
// domain or the invalid domain (“O” domain type). If there are more domains between DIE and PACKAGE, the unknown 
// domains will be ignored and treated as an extension of the last known domain (i.e., DIE in this case). 
// 
ECX++; 
execute cpuid with EAX = OBH or 1FH; 
} 
COREPlusLogical_Processor_MASK = ~( (-1) << Mask_Core_shift); 
DIEPlusCORE_MASK = ~( (-1) << Mask_Die_shift); 
// 
// Treat domains between DIE and physical package as an extension of DIE for software choosing not to implement or recognize 
// these unknown domains. 
// 
CORE_MASK = COREPlusLogical_Processor_MASK * Logical Processor Mask; 
DIE_MASK = DIEPlusCORE_MASK * COREPlusLogical_Processor_MASK; 
PACKAGE_MASK = (-1) << Mask_last_known_shift; 
return -1; 
} 
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9.9.3 Hierarchical ID of Logical Processors in an MP System 


For Intel 64 and IA-32 processors, system hardware establishes an 8-bit initial APIC ID (or 32-bit APIC ID if the 
processor supports CPUID leaf OBH) that is unique for each logical processor following power-up or RESET (see 
Section 9.6.1). Each logical processor on the system is allocated an initial APIC ID. BIOS may implement features 
that tell the OS to support less than the total number of logical processors on the system bus. Those logical proces- 
sors that are not available to applications at runtime are halted during the OS boot process. As a result, the number 
valid local APIC_IDs that can be queried by affinitizing-current-thread-context (See Example 9-23) is limited to the 
number of logical processors enabled at runtime by the OS boot process. 


Table 9-2 shows an example of the 8-bit APIC IDs that are initially reported for logical processors in a system with 
four Intel Xeon MP processors that support Intel Hyper-Threading Technology (a total of 8 logical processors, each 
physical package has two processor cores and supports Intel Hyper-Threading Technology). Of the two logical 
processors within a Intel Xeon processor MP, logical processor 0 is designated the primary logical processor and 
logical processor 1 as the secondary logical processor. 


LOGICAL_PROCESSOR_ID 
TO 1 TO T1 TO 1 TO 11 BORE? 
PACKAGE_ID 
Core 0 Core 1 Core 0 Core 1 
Package 0 Package 1 


Figure 9-7. Topological Relationships Between Hierarchical IDs in a Hypothetical MP Platform 


Table 9-2. Initial APIC IDs for the Logical Processors in a System that has Four Intel Xeon MP Processors Supporting 
Intel Hyper-Threading Technology! 


Initial APIC ID PACKAGE_ID CORE_ID LOGICAL_PROCESSOR_ID 
OH OH OH OH 
1H OH OH 1H 
2H 1H OH OH 
3H 1H OH 1H 
4H 2H OH OH 
5H 2H OH 1H 
6H 3H OH OH 
7H 3H OH 1H 


NOTE: 


1. Because information on the number of processor cores in a physical package was not available in early single-core processors sup- 
porting Intel Hyper-Threading Technology, the CORE_ID can be treated as O. 


Table 9-3 shows the initial APIC IDs for a hypothetical situation with a dual processor system. Each physical 
package providing two processor cores, and each processor core also supporting Intel Hyper-Threading Tech- 
nology. 
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Table 9-3. Initial APIC IDs for the Logical Processors in a System that has Two Physical Processors Supporting Dual- 
Core and Intel Hyper-Threading Technology 


Initial APIC ID PACKAGE_ID CORE_ID LOGICAL_PROCESSOR_ID 
OH OH OH OH 
1H OH OH 1H 
2H OH 1H OH 
3H OH 1H 1H 
4H 1H OH OH 
5H 1H OH 1H 
6H 1H 1H OH 
7H 1H 1H 1H 


9.9.3.1 Hierarchical ID of Logical Processors with x2APIC ID 


Table 9-4 shows an example of possible x2APIC ID assignments for a dual processor system that support x2APIC. 
Each physical package providing four processor cores, and each processor core also supporting Intel Hyper- 
Threading Technology. Note that the x2APIC ID need not be contiguous in the system. 


Table 9-4. Example of Possible x2APIC ID Assignment in a System that has Two Physical Processors Supporting 
x2APIC and Intel Hyper-Threading Technology 


x2APIC ID PACKAGE_ID CORE_ID LOGICAL_PROCESSOR_ID 
OH OH OH OH 
1H OH OH 1H 
2H OH 1H OH 
3H OH 1H 1H 
4H OH 2H OH 
5H OH 2H 1H 
6H OH 3H OH 
7H OH 3H 1H 
10H 1H OH OH 
11H 1H OH 1H 
12H 1H 1H OH 
13H 1H 1H 1H 
14H 1H 2H OH 
15H 1H 2H 1H 
16H 1H 3H OH 
17H 1H 3H 1H 
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9.9.4 Algorithm for Three-Domain Mappings of APIC_ID 


Software can gather the initial APIC_IDs for each logical processor supported by the operating system at runtime? 
and extract identifiers corresponding to the three domains of sharing topology (package, core, and logical 
processor). The three-domain algorithms below focus on a non-clustered MP system for simplicity. They do not 
assume APIC IDs are contiguous or that all logical processors on the platform are enabled. 


Intel supports multi-threading systems where all physical processors report identical values in CPUID leaf OBH, 
CPUID.1:EBX[23:16]), CPUID.4*:EAX[31:26], and CPUID.4?:EAX[25:14]. The algorithms below assume the 
target system has symmetry across physical package boundaries with respect to the number of logical processors 
per package, number of cores per package, and cache topology within a package. 


Software can choose to assume three-domain hierarchy if it was developed to understand only three domains. 
However, software implementation needs to ensure it does not break if it runs on systems that have more domains 
in the hierarchy even if it does not recognize them. 


The extraction algorithm (for three-domain mappings from an APIC ID) uses the general procedure depicted in 
Example 9-19, and is supplemented by more detailed descriptions on the derivation of topology enumeration 
parameters for extraction bit masks: 


1. Detect hardware multi-threading support in the processor. 


2. Derive a set of bit masks that can extract the sub ID of each hierarchical domain of the topology. The algorithm 
to derive extraction bit masks for LOGICAL_PROCESSOR_ID/CORE_ID/PACKAGE_ID differs based on APIC ID 
is 32-bit (see step 3 below) or 8-bit (see step 4 below). 


3. If the processor supports CPUID leaf OBH, each APIC ID contains a 32-bit value, the topology enumeration 
parameters needed to derive three-domain extraction bit masks are: 


a. Query the right-shift value for the LOGICAL_PROCESSOR_ID domain of the topology using CPUID leaf OBH 
with ECX =0H as input. The number of bits to shift-right on x2APIC ID (EAX[4:0]) can distinguish different 
higher-domain entities above logical processor in the same physical package. This is also the width of the 
bit mask to extract the LOGICAL_PROCESSOR_ID. The shift value may be 0 and enumerate no logical 
processor bit mask to create. A platform where cores only have one logical processor are not required to 
enumerate a separate bit layout for logical processor, and the lowest bits may only identify the core (where 
core and logical processor are then synonymous). 


b. Enumerate until the desired domain is found (i.e., processor cores). Determine if the next domain is the 
expected domain. If the next domain is not known to the software, keep enumerating until the next known 
or the last domain. Software should use the previous domain before this to represent the last previously 
known domain (i.e., processor cores). If the software does not recognize or implement certain hierarchical 
domains, it should assume these unknown domains as an extension of the last known domain. 


c. Query CPUID leaf OBH for the amount of bit shift to distinguish next higher-domain entities (e.g., physical 
processor packages) in the system. This describes an explicit three-domain-topology situation for 
commonly available processors. Consult Example 9-17 to adapt to situations beyond a three-domain 
topology of a physical processor. The width of the extraction bit mask can be used to derive the cumulative 
extraction bitmask to extract the sub IDs of logical processors (including different processor cores) in the 
same physical package. The extraction bit mask to distinguish merely different processor cores can be 
derived by xor’ing the logical processor extraction bit mask from the cumulative extraction bit mask. 


d. Query the 32-bit x2APIC ID for the logical processor where the current thread is executing. 


e. Derive the extraction bit masks corresponding to LOGICAL_PROCESSOR_ID, CORE_ID, and PACKAGE_ID, 
starting from LOGICAL_PROCESSOR_ID. 


f. Apply each extraction bit mask to the 32-bit x2APIC ID to extract sub-field IDs. 


1. As noted in Section 9.6 and Section 9.9.3, the number of logical processors supported by the OS at runtime may be less than the 
total number logical processors available in the platform hardware. 


2. Maximum number of addressable ID for processor cores in a physical processor is obtained by executing CPUID with EAX=4 anda 
valid ECX index. The ECX index starts at 0. 


3. Maximum number addressable ID for processor cores sharing the target cache level is obtained by executing CPUID with EAX = 4 
and the ECX index corresponding to the target cache level. 
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4. 


If the processor does not support CPUID leaf OBH, each initial APIC ID contains an 8-bit value, the topology 
enumeration parameters needed to derive extraction bit masks are: 


a. Query the size of address space for sub IDs that can accommodate logical processors in a physical 
processor package. This size parameters (CPUID.1:EBX[23:16]) can be used to derive the width of an 
extraction bitmask to enumerate the sub IDs of different logical processors in the same physical package. 


b. Query the size of address space for sub IDs that can accommodate processor cores in a physical processor 
package. This size parameters can be used to derive the width of an extraction bitmask to enumerate the 
sub IDs of processor cores in the same physical package. 


c. Query the 8-bit initial APIC ID for the logical processor where the current thread is executing. 


d. Derive the extraction bit masks using respective address sizes corresponding to LOGICAL_PROCESSOR_ID, 
CORE_ID, and PACKAGE_ID, starting from LOGICAL_PROCESSOR_ID. 


e. Apply each extraction bit mask to the 8-bit initial APIC ID to extract sub-field IDs. 


Example 9-19. Support Routines for Detecting Hardware Multi-Threading and Identifying the Relationships Between Package, 
Core, and Logical Processors 


1. 


// 
// 
// 
// 
// 


Detect support for Hardware Multi-Threading Support in a processor. 


Returns a non-zero value if CPUID reports the presence of hardware multi-threading 
support in the physical package where the current logical processor is located. 

This does not guarantee BIOS or OS will enable all logical processors in the physical 
package and make them available to applications. 

Returns zero if hardware multi-threading is not present. 


#define HWMT_BIT 10000000H 


unsigned int HWMTSupported(void) 


{ 


// ensure cpuid instruction is supported 
execute cpuid with eax = O to get vendor string 
execute cpuid with eax = 1 to get feature flag and signature 


// Check to see if this a Genuine Intel Processor 


if (vendor string EQ Genuinelntel) { 
return (feature_flag_edx & HWMT_BIT); // bit 28 
} 


return 0; 


Example 9-20. Support Routines for Identifying Package, Core, and Logical Processors from 32-bit x2APIC ID 


a. 


Derive the extraction bitmask for logical processors in a processor core and associated mask offset for different 
cores. 


int DeriveLogical_Processor_Mask_Offsets (void) 


{ 


if (HWMTSupported()) return -1; 
execute cpuid with eax = 11, ECX = 0; 
If (returned domain type encoding in ECX[15:8] does not match logical processor) return -1; 
Mask_Logical_Processor_shift = EAX[4:0]; // # bits shift right of APIC ID to distinguish different cores, note this can be a shift 
// of zero if there is only one logical processor per core. 
Logical Processor Mask = ~( (-1) << Mask_Logical_Processor_shift); // shift left to derive extraction bitmask for 
// LOGICAL_PROCESSOR_ID 
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return 0; 


b. Derive the extraction bitmask for processor cores in a physical processor package and associated mask offset for 
different packages. 


int DeriveCore_Mask_Offsets (void) 


{ 
if (HWMTSupported()) return -1; 
execute cpuid with eax = 11, ECX = 0; 


while( ECX[1 5:8] ) { // domain type encoding is valid 
Mask_Core_shift = EAX[4:0]; // needed to distinguish different physical packages 
ECX ++; 


execute cpuid with eax = 11; 


} 
COREPlusLogical_Processor_MASK = ~( (-1) << Mask_Core_shift); 


// treat domains between core and physical package as a core for software choosing not to implement or recognize 
// these unknown domains 

CORE_MASK = COREPlusLogical_Processor_MASK * Logical Processor Mask; 

PACKAGE_MASK = (-1) << Mask_Core_shift; 

return -1; 


c. Query the x2APIC ID of a logical processor. 


APIC_IDs for each logical processor. 


unsigned char Getx2APIC_ID (void) 


{ 
unsigned reg_edx = 0; 
execute cpuid with eax = 11, ECX = 0 
store returned value of edx 
return (unsigned) (reg_edx) ; 
} 


Example 9-21. Support Routines for Identifying Package, Core, and Logical Processors from 8-bit Initial APIC ID 
a. Find the size of address space for logical processors in a physical processor package. 
#define NUM_LOGICAL_BITS OOFFOOOOH 


// Use the mask above and CPUID.1.€BX[23:16] to obtain the max number of addressable IDs 
// for logical processors in a physical package, 


//Returns the size of address space of logical processors in a physical processor package; 
// Software should not assume the value to be a power of 2. 


unsigned char MaxLPIDsPerPackage(void) 
if (HWMTSupported()) return 1; 
execute cpuid with eax = 1 


store returned value of ebx 
return (unsigned char) ((reg_ebx & NUM_LOGICAL_BITS) >> 16); 
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b. Find the size of address space for processor cores in a physical processor package. 


// Returns the max number of addressable IDs for processor cores in a physical processor package; 
// Software should not assume cpuid reports this value to be a power of 2. 


unsigned MaxCorelDsPerPackage(void) 
{ 
if (HWMTSupported()) return (unsigned char) 1; 
if cpuid supports leaf number 4 
{ // we can retrieve multi-core topology info using leaf 4 
execute cpuid with eax = 4, ecx = 0 
store returned value of eax 
return (unsigned) ((reg_eax >> 26) +1); 
} 
else // must be a single-core processor 
return 1; 


} 
c. Query the initial APIC ID of a logical processor. 


#define INITIAL_APIC_ID_BITS FFOOOOOOH // CPUID.1.€BX[31:24] initial APIC ID 
// Returns the 8-bit unique initial APIC ID for the processor running the code. 
// Software can use OS services to affinitize the current thread to each logical processor 


// available under the OS to gather the initial APIC_IDs for each logical processor. 


unsigned GetInitAPIC_ID (void) 


{ 

unsigned int reg_ebx = 0; 

execute cpuid with eax = 1 

store returned value of ebx 

return (unsigned) ((reg_ebx & INITIAL_APIC_ID_BITS) >> 24; 
} 


d. Find the width of an extraction bitmask from the maximum count of the bit-field (address size). 


// Returns the mask bit width of a bit field from the maximum count that bit field can represent. 

// This algorithm does not assume ‘address size’ to have a value equal to power of 2. 

// Address size for LOGICAL_PROCESSOR_ID can be calculated from MaxLPIDsPerPackage()/MaxCorelDsPerPackage() 
// Then use the routine below to derive the corresponding width of logical processor extraction bitmask 

// Address size for CORE_ID is MaxCorelDsPerPackage(), 

// Derive the bitwidth for CORE extraction mask similarly 


unsigned FindMaskWidth(Unsigned Max_Count) 
{unsigned int mask_width, cnt = Max_Count; 
__asm { 

mov eax, cnt 

mov ecx, 0 

mov mask_width, ecx 

dec eax 

bsr Cx, ax 

jz next 

inc cx 

mov mask_width, ecx 

next: 

mov eax, mask_width 
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} 


return mask_width; 
} 


e. Extract a sub ID from an 8-bit full ID, using address size of the sub ID and shift count. 


// The routine below can extract LOGICAL_PROCESSOR_ID, CORE_ID, and PACKAGE_ID respectively from the init APIC_ID 

// To extract LOGICAL_PROCESSOR_ID, MaxSubIDvalue is set to the address size of LOGICAL_PROCESSOR_ID, Shift_Count = 0 

// To extract CORE_ID, MaxSubIDvalue is the address size of CORE_ID, Shift_Count is width of logical processor extraction bitmask. 
// Returns the value of the sub ID, this is not a zero-based value 


Unsigned char GetSub!ID(unsigned char Full_ID, unsigned char MaxSub!IDvalue, unsigned char Shift_Count) 
i 

MaskWidth = FindMaskWidth(MaxSubIDValue); 

MaskBits = ((uchar) (FFH << Shift_Count)) * ((uchar) (FFH << Shift_Count + MaskWidth)) ; 

SublD = Full_ID & MaskBits; 

Return SublD; 


Software must not assume local APIC_ID values in an MP system are consecutive. Non-consecutive local APIC_IDs 
may be the result of hardware configurations or debug features implemented in the BIOS or OS. 


An identifier for each hierarchical domain can be extracted from an 8-bit APIC_ID using the support routines illus- 
trated in Example 9-21. The appropriate bit mask and shift value to construct the appropriate bit mask for each 
domain must be determined dynamically at runtime. 


9.9.5 Identifying Topological Relationships in an MP System 


To detect the number of physical packages, processor cores, or other topological relationships in a MP system, the 
following procedures are recommended: 


e Extract the three-domain identifiers from the APIC ID of each logical processor enabled by system software. 
The sequence is as follows (see the pseudo code shown in Example 9-22 and support routines shown in 
Example 9-19): 


¢ The extraction start from the right-most bit field, corresponding to LOGICAL_PROCESSOR_ID, the 
innermost hierarchy in a three-domain topology (See Figure 9-7). For the right-most bit field, the shift 
value of the working mask is zero. The width of the bit field is determined dynamically using the 
maximum number of logical processor per core, which can be derived from information provided from 
CPUID. 


¢ To extract the next bit-field, the shift value of the working mask is determined from the width of the bit 
mask of the previous step. The width of the bit field is determined dynamically using the maximum 
number of cores per package. 


* To extract the remaining bit-field, the shift value of the working mask is determined from the maximum 
number of logical processor per package. So the remaining bits in the APIC ID (excluding those bits 
already extracted in the two previous steps) are extracted as the third identifier. This applies to a non- 
clustered MP system, or if there is no need to distinguish between PACKAGE_ID and CLUSTER_ID. 


If there is need to distinguish between PACKAGE_ID and CLUSTER_ID, PACKAGE_ID can be extracted 
using an algorithm similar to the extraction of CORE_ID, assuming the number of physical packages in 
each node of a clustered system is symmetric. 
e Assemble the three-domain identifiers of LOGICAL_PROCESSOR_ID, CORE_ID, PACKAGE_IDs into arrays for 
each enabled logical processor. This is shown in Example 9-23a. 
° To detect the number of physical packages: use PACKAGE_ID to identify those logical processors that reside in 
the same physical package. This is shown in Example 9-23b. This example also depicts a technique to construct 
a mask to represent the logical processors that reside in the same package. 
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* To detect the number of processor cores: use CORE_ID to identify those logical processors that reside in the 
same core. This is shown in Example 9-23. This example also depicts a technique to construct a mask to 
represent the logical processors that reside in the same core. 


In Example 9-22, the numerical ID value can be obtained from the value extracted with the mask by shifting it right 
by shift count. Algorithms below do not shift the value. The assumption is that the SubID values can be compared 
for equivalence without the need to shift. 


Example 9-22. Pseudo Code Depicting Three-Domain Extraction Algorithm 


For Each local_APIC_ID{ 
// Calculate Logical Processor Mask, the bit mask pattern to extract LOGICAL_PROCESSOR_ID, 
// Logical Processor Mask is determined using topology enumertaion parameters 
// from CPUID leaf OBH (Example 9-20); 
// otherwise, Logical Processor Mask is determined using CPUID leaf 01H and leaf O4H (Example 9-21). 
// This algorithm assumes there is symmetry across core boundary, i.e., each core within a 
// package has the same number of logical processors 
// LOGICAL_PROCESSOR_ID always starts from bit 0, corresponding to the right-most bit-field 
LOGICAL_PROCESSOR_ID = APIC_ID & Logical Processor Mask; 


// Extract CORE_ID: 
// Core Mask is determined in Example 9-20 or Example 9-21 
CORE_ID = (APIC_ID & Core Mask); 


// Extract PACKAGE_ID: 

// Assume single cluster. 

// Shift out the mask width for maximum logical processors per package 
// Package Mask is determined in Example 9-20 or Example 9-21 
PACKAGE_ID = (APIC_ID & Package Mask) ; 


Example 9-23. Compute the Number of Packages, Cores, and Processor Relationships in a MP System 
a) Assemble lists of PACKAGE_ID, CORE_ID, and LOGICAL_PROCESSOR_ID of each enabled logical processors 


// The BIOS and/or OS may limit the number of logical processors available to applications after system boot. 
// The below algorithm will compute topology for the processors visible to the thread that is computing it. 


// Extract the 3-domains of IDs on every processor. 

// SystemAffinity is a bitmask of all the processors started by the OS. Use OS specific APls to obtain it. 

// ThreadAffinityMask is used to affinitize the topology enumeration thread to each processor using OS specific APIs. 

// Allocate per processor arrays to store the Package_ID, Core_ID, and LOGICAL_PROCESSOR_ID for every started processor. 


ThreadAffinityMask = 1; 
ProcessorNum = 0; 
while (ThreadAffinityMask # 0 && ThreadAffinityMask <= SystemAffinity) { 
// Check to make sure we can utilize this processor first. 
if (ThreadAffinityMask & SystemAffinity){ 
Set thread to run on the processor specified in ThreadAffinityMask 
Wait if necessary and ensure thread is running on specified processor 


APIC_ID = GetAPIC_ID(); // 32 bit ID in Example 9-20 or 8-bit ID in Example 9-21 

Extract the Package_ID, Core_ID, and LOGICAL_PROCESSOR_ID as explained in three domain extraction 
algorithm of Example 9-22 

PackagelD[ProcessorNUM] = PACKAGE_ID; 

CorelD[ProcessorNum] = CORE_ID; 
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LOGICAL_PROCESSOR_ID[ProcessorNum] = LOGICAL_PROCESSOR_ID; 
ProcessorNum++; 
} 
ThreadAffinityMask <<= 1; 
} 


NumStartedLPs = ProcessorNum; 


b) Using the list of PACKAGE_ID to count the number of physical packages in a MP system and construct, for each package, a multi-bit 
mask corresponding to those logical processors residing in the same package. 


// Compute the number of packages by counting the number of processors with unique PACKAGE_IDs in the PackagelD array. 
// Compute the mask of processors in each package. 


// PackagelDBucket is an array of unique PACKAGE_ID values. Allocate an array of NumStartedLPs count of entries in this array. 
// PackageProcessorMask is a corresponding array of the bit mask of processors belonging to the same package, these are 

// processors with the same PACKAGE_ID. 

// The algorithm below assumes there is symmetry across package boundary if more than one socket is populated in an MP 
//system. 

// Bucket Package IDs and compute processor mask for every package. 


PackageNum = 1; 
PackagelDBucket[O] = PackagelD[0]; 
ProcessorMask = 1; 
PackageProcessorMask[0] = ProcessorMask; 
For (ProcessorNum = 1; ProcessorNum < NumStartedLPs; ProcessorNum++) { 
ProcessorMask << = 1; 
For (i=0; i < PackageNum; i++) { 
// we may be comparing bit-fields of logical processors residing in different 
// packages, the code below assume package symmetry 
If (PackagelD[ProcessorNum] = PackagelDBucket[i]) { 
PackageProcessorMask{[i] |= ProcessorMask; 
Break; // found in existing bucket, skip to next iteration 
} 
} 
if (i =PackageNum) { 
//PACKAGE_ID did not match any bucket, start new bucket 
PackagelDBucket{[i] = PackagelD[ProcessorNum]; 
PackageProcessorMask[i] = ProcessorMask; 
PackageNum++; 
} 
} 


// PackageNum has the number of Packages started in OS 
// PackageProcessorMask[] array has the processor set of each package 


c) Using the list of CORE_ID to count the number of cores ina MP system and construct, for each core, a multi-bit mask corresponding 
to those logical processors residing in the same core. 


Processors in the same core can be determined by bucketing the processors with the same PACKAGE_ID and CORE_ID. Note that code 
below can BIT OR the values of PACKGE and CORE ID because they have not been shifted right. 
The algorithm below assumes there is symmetry across package boundary if more than one socket is populated in an MP system. 


//Bucketing PACKAGE and CORE IDs and computing processor mask for every core 
CoreNum = 1; 
CorelDBucket[0] = PackagelD[O] | CorelD[O]; 
ProcessorMask = 1; 
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CoreProcessorMask[0] = ProcessorMask; 
For (ProcessorNum = 1; ProcessorNum < NumStartedLPs; ProcessorNum++) { 
ProcessorMask << = 1; 
For (i=0; i < CoreNum; i++) { 
// we may be comparing bit-fields of logical processors residing in different 
// packages, the code below assume package symmetry 
If ((PackagelD[ProcessorNum] | CorelD[ProcessorNum]) = CorelDBuckei[i]) { 
CoreProcessorMask{i] |= ProcessorMask; 
Break; // found in existing bucket, skip to next iteration 
} 
} 
if (i = CoreNum) { 
//Did not match any bucket, start new bucket 
CorelDBucket[i] = PackagelD[ProcessorNum] | CorelD[ProcessorNum]; 
CoreProcessorMask[i] = ProcessorMask; 
CoreNum++; 
} 
} 
// CoreNum has the number of cores started in the OS 
// CoreProcessorMask[] array has the processor set of each core 


Other processor relationships such as processor mask of sibling cores can be computed from set operations of the 
PackageProcessorMask[] and CoreProcessorMask[]. 


The algorithm shown above can be adapted to work with earlier generations of single-core IA-32 processors that 
support Intel Hyper-Threading Technology and in situations that the deterministic cache parameter leaf is not 
supported (provided CPUID supports initial APIC ID). A reference code example is available (see Intel® 64 Archi- 
tecture Processor Topology Enumeration Technical Paper). 


9.10 MANAGEMENT OF IDLE AND BLOCKED CONDITIONS 


When a logical processor in an MP system (including multi-core processor or processors supporting Intel Hyper- 
Threading Technology) is idle (no work to do) or blocked (on a lock or semaphore), additional management of the 
core execution engine resource can be accomplished by using the HLT (halt), PAUSE, or the MONITOR/MWAIT 
instructions. 


9.10.1 HLT Instruction 


The HLT instruction stops the execution of the logical processor on which it is executed and places it in a halted 
state until further notice (see the description of the HLT instruction in Chapter 3 of the Intel® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 2A). When a logical processor is halted, active logical processors 
continue to have full access to the shared resources within the physical package. Here shared resources that were 
being used by the halted logical processor become available to active logical processors, allowing them to execute 
at greater efficiency. When the halted logical processor resumes execution, shared resources are again shared 
among all active logical processors. (See Section 9.10.6.3, “Halt Idle Logical Processors,” for more information 
about using the HLT instruction with processors supporting Intel Hyper-Threading Technology. ) 


9.10.2 PAUSE Instruction 


The PAUSE instruction can improves the performance of processors supporting Intel Hyper-Threading Technology 
when executing “spin-wait loops” and other routines where one thread is accessing a shared lock or semaphore in 
a tight polling loop. When executing a spin-wait loop, the processor can suffer a severe performance penalty when 
exiting the loop because it detects a possible memory order violation and flushes the core processor’s pipeline. The 
PAUSE instruction provides a hint to the processor that the code sequence is a spin-wait loop. The processor uses 


9-48 Vol. 3A 


MULTIPLE-PROCESSOR MANAGEMENT 


this hint to avoid the memory order violation and prevent the pipeline flush. In addition, the PAUSE instruction de- 
pipelines the spin-wait loop to prevent it from consuming execution resources excessively and consume power 
needlessly. (See Section 9.10.6.1, “Use the PAUSE Instruction in Spin-Wait Loops,” for more information about 
using the PAUSE instruction with IA-32 processors supporting Intel Hyper-Threading Technology. ) 


9.10.3. Detecting Support MONITOR/MWAIT Instruction 


Streaming SIMD Extensions 3 introduced two instructions (MONITOR and MWAIT) to help multithreaded software 
improve thread synchronization. In the initial implementation, MONITOR and MWAIT are available to software at 
ring O. The instructions are conditionally available at levels greater than O. Use the following steps to detect the 
availability of MONITOR and MWAIT: 


¢ Use CPUID to query the MONITOR bit (CPUID.1.ECX[3] = 1). 


¢ If CPUID indicates support, execute MONITOR inside a TRY/EXCEPT exception handler and trap for an 
exception. If an exception occurs, MONITOR and MWAIT are not supported at a privilege level greater than 0. 
See Example 9-24. 


Example 9-24. Verifying MONITOR/MWAIT Support 


boolean MONITOR_MWAIT_works = TRUE; 
try { 
_asm { 
XOF @CX, ECX 
xor edx, edx 
mov eax, MemArea 
monitor 
} 
// Use monitor 
} except (UNWIND) { 
// if we get here, MONITOR/MWAIT is not supported 
MONITOR_MWAIT_works = FALSE; 


9.10.4 MONITOR/MWAIT Instruction 


Operating systems usually implement idle loops to handle thread synchronization. In a typical idle-loop scenario, 
there could be several “busy loops” and they would use a set of memory locations. An impacted processor waits in 
a loop and poll a memory location to determine if there is available work to execute. The posting of work is typically 
a write to memory (the work-queue of the waiting processor). The time for initiating a work request and getting it 
scheduled is on the order of a few bus cycles. 


From a resource sharing perspective (logical processors sharing execution resources), use of the HLT instruction in 
an OS idle loop is desirable but has implications. Executing the HLT instruction on a idle logical processor puts the 
targeted processor in a non-execution state. This requires another processor (when posting work for the halted 
logical processor) to wake up the halted processor using an inter-processor interrupt. The posting and servicing of 
such an interrupt introduces a delay in the servicing of new work requests. 


In a shared memory configuration, exits from busy loops usually occur because of a state change applicable to a 
specific memory location; such a change tends to be triggered by writes to the memory location by another agent 
(typically a processor). 


MONITOR/MWAIT complement the use of HLT and PAUSE to allow for efficient partitioning and un-partitioning of 
shared resources among logical processors sharing physical resources. MONITOR sets up an effective address 
range that is monitored for write-to-memory activities; MWAIT places the processor in an optimized state (this 
may vary between different implementations) until a write to the monitored address range occurs. 


In the initial implementation of MONITOR and MWAIT, they are available at CPL = 0 only. 
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Both instructions rely on the state of the processor’s monitor hardware. The monitor hardware can be either armed 
(by executing the MONITOR instruction) or triggered (due to a variety of events, including a store to the monitored 
memory region). If upon execution of MWAIT, monitor hardware is in a triggered state: MWAIT behaves as a NOP 
and execution continues at the next instruction in the execution stream. The state of monitor hardware is not archi- 
tecturally visible except through the behavior of MWAIT. 


Multiple events other than a write to the triggering address range can cause a processor that executed MWAIT to 
wake up. These include events that would lead to voluntary or involuntary context switches, such as: 


¢ External interrupts, including NMI, SMI, INIT, BINIT, MCERR, A2ZOM# 
¢ Faults, Aborts (including Machine Check) 


¢ Architectural TLB invalidations including writes to CRO, CR3, CR4, and certain MSR writes; execution of LMSW 
(occurring prior to issuing MWAIT but after setting the monitor) 


¢ Voluntary transitions due to fast system call and far calls (occurring prior to issuing MWAIT but after setting the 
monitor) 


Power management related events (such as Thermal Monitor 2 or chipset driven STPCLK# assertion) will not cause 
the monitor event pending flag to be cleared. Faults will not cause the monitor event pending flag to be cleared. 


Software should not allow for voluntary context switches in between MONITOR/MWAIT in the instruction flow. Note 
that execution of MWAIT does not re-arm the monitor hardware. This means that MONITOR/MWAIT need to be 
executed in a loop. Also note that exits from the MWAIT state could be due to a condition other than a write to the 
triggering address; software should explicitly check the triggering data location to determine if the write occurred. 
Software should also check the value of the triggering address following the execution of the monitor instruction 
(and prior to the execution of the MWAIT instruction). This check is to identify any writes to the triggering address 
that occurred during the course of MONITOR execution. 


The address range provided to the MONITOR instruction must be of write-back caching type. Only write-back 
memory type stores to the monitored address range will trigger the monitor hardware. If the address range is not 
in memory of write-back type, the address monitor hardware may not be set up properly or the monitor hardware 
may not be armed. Software is also responsible for ensuring that 


° Writes that are not intended to cause the exit of a busy loop do not write to a location within the address region 
being monitored by the monitor hardware, 


°* Writes intended to cause the exit of a busy loop are written to locations within the monitored address region. 


Not doing so will lead to more false wakeups (an exit from the MWAIT state not due to a write to the intended data 
location). These have negative performance implications. It might be necessary for software to use padding to 
prevent false wakeups. CPUID provides a mechanism for determining the size data locations for monitoring as well 
as a mechanism for determining the size of a the pad. 


9.10.5 Monitor/Mwait Address Range Determination 


To use the MONITOR/MWAIT instructions, software should know the length of the region monitored by the 
MONITOR/MWAITT instructions and the size of the coherence line size for cache-snoop traffic in a multiprocessor 
system. This information can be queried using the CPUID monitor leaf function (EAX = 05H). You will need the 
smallest and largest monitor line size: 


° To avoid missed wake-ups: make sure that the data structure used to monitor writes fits within the smallest 
monitor line-size. Otherwise, the processor may not wake up after a write intended to trigger an exit from 
MWATT. 


° To avoid false wake-ups; use the largest monitor line size to pad the data structure used to monitor writes. 
Software must make sure that beyond the data structure, no unrelated data variable exists in the triggering 
area for MWAIT. A pad may be needed to avoid this situation. 


These above two values bear no relationship to cache line size in the system and software should not make any 
assumptions to that effect. Within a single-cluster system, the two parameters should default to be the same (the 
size of the monitor triggering area is the same as the system coherence line size). 


Based on the monitor line sizes returned by the CPUID, the OS should dynamically allocate structures with appro- 
priate padding. If static data structures must be used by an OS, attempt to adapt the data structure and use a 
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dynamically allocated data buffer for thread synchronization. When the latter technique is not possible, consider 
not using MONITOR/MWAIT when using static data structures. 


To set up the data structure correctly for MONITOR/MWAIT on multi-clustered systems: interaction between 
processors, chipsets, and the BIOS is required (system coherence line size may depend on the chipset used in the 
system; the size could be different from the processor’s monitor triggering area). The BIOS is responsible to set the 
correct value for system coherence line size using the IA32_MONITOR_FILTER_LINE_SIZE MSR. Depending on the 
relative magnitude of the size of the monitor triggering area versus the value written into the IA32_MONITOR_FIL- 
TER_LINE_SIZE MSR, the smaller of the parameters will be reported as the Smallest Monitor Line Size. The larger 
of the parameters will be reported as the Largest Monitor Line Size. 


9.10.6 Required Operating System Support 


This section describes changes that must be made to an operating system to run on processors supporting Intel 
Hyper-Threading Technology. It also describes optimizations that can help an operating system make more effi- 
cient use of the logical processors sharing execution resources. The required changes and suggested optimizations 
are representative of the types of modifications that appear in Windows* XP and Linux* kernel 2.4.0 operating 
systems for Intel processors supporting Intel Hyper-Threading Technology. Additional optimizations for processors 
supporting Intel Hyper-Threading Technology are described in the Intel® 64 and IA-32 Architectures Optimization 
Reference Manual. 


9.10.6.1 Use the PAUSE Instruction in Spin-Wait Loops 


Intel recommends that a PAUSE instruction be placed in all spin-wait loops that run on Intel processors supporting 
Intel Hyper-Threading Technology and multi-core processors. 


Software routines that use spin-wait loops include multiprocessor synchronization primitives (spin-locks, sema- 
phores, and mutex variables) and idle loops. Such routines keep the processor core busy executing a load-compare- 
branch loop while a thread waits for a resource to become available. Including a PAUSE instruction in such a loop 
greatly improves efficiency (see Section 9.10.2, “PAUSE Instruction”). The following routine gives an example of a 
spin-wait loop that uses a PAUSE instruction: 


Spin_Lock: 
CMP lockvar, 0 Check if lock is free 
JE Get_Lock 
PAUSE ;Short delay 
JMP Spin_Lock 
Get_Lock: 
MOV EAX, 1 
XCHG EAX, lockvar ;Try to get lock 
CMP EAX, 0 Test if successful 
JNE Spin_Lock 
Critical_Section: 
<critical section code> 
MOV lockvar, 0 


Continue: 


The spin-wait loop above uses a “test, test-and-set” technique for determining the availability of the synchroniza- 
tion variable. This technique is recommended when writing spin-wait loops. 


In IA-32 processor generations earlier than the Pentium 4 processor, the PAUSE instruction is treated as a NOP 
instruction. 


9.10.6.2 Potential Usage of MONITOR/MWAIT in CO Idle Loops 


An operating system may implement different handlers for different idle states. A typical OS idle loop on an ACPI- 
compatible OS is shown in Example 9-25: 
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Example 9-25. A Typical OS Idle Loop 


// WorkQueue is a memory location indicating there is a thread 

// ready to run. A non-zero value for WorkQueue is assumed to 

// indicate the presence of work to be scheduled on the processor. 
// The idle loop is entered with interrupts disabled. 


WHILE (1) { 
IF (WorkQueue) THEN { 
// Schedule work at WorkQueue. 
} 
ELSE { 
// No work to do - wait in appropriate C-state handler depending 
// on Idle time accumulated 
IF (IdleTime >= IdleTimeThreshhold) THEN { 
// Call appropriate C1, C2, C3 state handler, C1 handler 
// shown below 
} 
} 


// C1 handler uses a Halt instruction 
VOID C1Handler() 
{ STI 

HLT 


} 


The MONITOR and MWAIT instructions may be considered for use in the CO idle state loops, if MONITOR and MWAIT are supported. 


Example 9-26. An OS Idle Loop with MONITOR/MWAIT in the CO Idle Loop 


// WorkQueue is a memory location indicating there is a thread 

// ready to run. A non-zero value for WorkQueue is assumed to 

// indicate the presence of work to be scheduled on the processor. 

// The following example assumes that the necessary padding has been 
// added surrounding WorkQueue to eliminate false wakeups 

// The idle loop is entered with interrupts disabled. 


WHILE (1) { 
IF (WorkQueue) THEN { 
// Schedule work at WorkQueue. 
} 
ELSE { 
// No work to do - wait in appropriate C-state handler depending 
// on Idle time accumulated. 
IF (IdleTime >= IdleTimeThreshhold) THEN { 
// Call appropriate C1, C2, C3 state handler, C1 
// handler shown below 
MONITOR WorkQueue // Setup of eax with WorkQueue 


// LinearAddress, 
// ECX, EDX = 0 
IF (WorkQueue = 0) THEN { 
MWAIT 
} 
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} 
// C1 handler uses a Halt instruction. 
VOID C1Handler() 
{ STI 
HLT 


} 


9.10.6.3 Halt Idle Logical Processors 


If one of two logical processors is idle or in a spin-wait loop of long duration, explicitly halt that processor by means 
of a HLT instruction. 


In an MP system, operating systems can place idle processors into a loop that continuously checks the run queue 
for runnable software tasks. Logical processors that execute idle loops consume a significant amount of core’s 
execution resources that might otherwise be used by the other logical processors in the physical package. For this 
reason, halting idle logical processors optimizes the performance.! If all logical processors within a physical 
package are halted, the processor will enter a power-saving state. 


9.10.6.4 Potential Usage of MONITOR/MWAIT in C1 Idle Loops 


An operating system may also consider replacing HLT with MONITOR/MWAIT in its C1 idle loop. An example is 
shown in Example 9-27: 


Example 9-27. An OS Idle Loop with MONITOR/MWAIT in the C1 Idle Loop 


// \WorkQueue is a memory location indicating there is a thread 

// ready to run. A non-zero value for WorkQueue is assumed to 

// indicate the presence of work to be scheduled on the processor. 

// The following example assumes that the necessary padding has been 
// added surrounding WorkQueue to eliminate false wakeups 

// The idle loop is entered with interrupts disabled. 


WHILE (1) { 

IF (WorkQueue) THEN { 
// Schedule work at WorkQueue 
} 

ELSE { 
// No work to do - wait in appropriate C-state handler depending 
// on Idle time accumulated 
IF (IdleTime >= IdleTimeThreshhold) THEN { 
// Call appropriate C1, C2, C3 state handler, C1 
// handler shown below 


} 
} 
VOID C1Handler() 
{ MONITOR WorkQueue // Setup of eax with WorkQueue LinearAddress, 
// ECX, EDX = 0 


IF (WorkQueue = 0) THEN { 
STI 


1. Excessive transitions into and out of the HALT state could also incur performance penalties. Operating systems should evaluate the 
performance trade-offs for their operating system. 
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MWAIT /1 EAX, ECX = 0 
} 


9.10.6.5 Guidelines for Scheduling Threads on Logical Processors Sharing Execution Resources 


Because the logical processors, the order in which threads are dispatched to logical processors for execution can 
affect the overall efficiency of a system. The following guidelines are recommended for scheduling threads for 
execution. 


* Dispatch threads to one logical processor per processor core before dispatching threads to the other logical 
processor sharing execution resources in the same processor core. 


* In an MP system with two or more physical packages, distribute threads out over all the physical processors, 
rather than concentrate them in one or two physical processors. 


¢ Use processor affinity to assign a thread to a specific processor core or package, depending on the cache- 
sharing topology. The practice increases the chance that the processor’s caches will contain some of the 
thread’s code and data when it is dispatched for execution after being suspended. 


9.10.6.6 Eliminate Execution-Based Timing Loops 


Intel discourages the use of timing loops that depend on a processor’s execution speed to measure time. There are 
several reasons: 


* Timing loops cause problems when they are calibrated on a IA-32 processor running at one frequency and then 
executed on a processor running at another frequency. 


* Routines for calibrating execution-based timing loops produce unpredictable results when run on an IA-32 
processor supporting Intel Hyper-Threading Technology. This is due to the sharing of execution resources 
between the logical processors within a physical package. 


To avoid the problems described, timing loop routines must use a timing mechanism for the loop that does not 
depend on the execution speed of the logical processors in the system. The following sources are generally avail- 
able: 


¢ A high resolution system timer (for example, an Intel 8254). 
¢ A high resolution timer within the processor (such as, the local APIC timer or the time-stamp counter). 
For additional information, see the Intel® 64 and IA-32 Architectures Optimization Reference Manual. 


9.10.6.7 Place Locks and Semaphores in Aligned, 128-Byte Blocks of Memory 


When software uses locks or semaphores to synchronize processes, threads, or other code sections; Intel recom- 
mends that only one lock or semaphore be present within a cache line (or 128 byte sector, if 128-byte sector is 
supported). In processors based on Intel NetBurst microarchitecture (which support 128-byte sector consisting of 
two cache lines), following this recommendation means that each lock or semaphore should be contained in a 128- 
byte block of memory that begins on a 128-byte boundary. The practice minimizes the bus traffic required to 
service locks. 


9.11 MP INITIALIZATION FOR P6 FAMILY PROCESSORS 


This section describes the MP initialization process for systems that use multiple P6 family processors. This process 
uses the MP initialization protocol that was introduced with the Pentium Pro processor (see Section 9.4, “Multiple- 
Processor (MP) Initialization”). For P6 family processors, this protocol is typically used to boot 2 or 4 processors 
that reside on single system bus; however, it can support from 2 to 15 processors in a multi-clustered system when 
the APIC buses are tied together. Larger systems are not supported. 
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9.11.1 Overview of the MP Initialization Process for P6 Family Processors 


During the execution of the MP initialization protocol, one processor is selected as the bootstrap processor (BSP) 
and the remaining processors are designated as application processors (APs), see Section 9.4.1, “BSP and AP 
Processors.” Thereafter, the BSP manages the initialization of itself and the APs. This initialization includes 
executing BIOS initialization code and operating-system initialization code. 


The MP protocol imposes the following requirements and restrictions on the system: 
¢ An APIC clock (APICLK) must be provided. 


¢ The MP protocol will be executed only after a power-up or RESET. If the MP protocol has been completed and a 
BSP has been chosen, subsequent INITs (either to a specific processor or system wide) do not cause the MP 
protocol to be repeated. Instead, each processor examines its BSP flag (in the APIC_BASE MSR) to determine 
whether it should execute the BIOS boot-strap code (if it is the BSP) or enter a wait-for-SIPI state (if it is an 
AP). 

¢ All devices in the system that are capable of delivering interrupts to the processors must be inhibited from 
doing so for the duration of the MP initialization protocol. The time during which interrupts must be inhibited 
includes the window between when the BSP issues an INIT-SIPI-SIPI sequence to an AP and when the AP 
responds to the last SIPI in the sequence. 


The following special-purpose interprocessor interrupts (IPIs) are used during the boot phase of the MP initializa- 
tion protocol. These IPIs are broadcast on the APIC bus. 


* Boot IPI (BIPI)—Initiates the arbitration mechanism that selects a BSP from the group of processors on the 
system bus and designates the remainder of the processors as APs. Each processor on the system bus 
broadcasts a BIPI to all the processors following a power-up or RESET. 


¢ Final Boot IPI (FIPI)—Initiates the BIOS initialization procedure for the BSP. This IPI is broadcast to all the 
processors on the system bus, but only the BSP responds to it. The BSP responds by beginning execution of the 
BIOS initialization code at the reset vector. 


¢ Startup IPI (SIPI)—Initiates the initialization procedure for an AP. The SIPI message contains a vector to the AP 
initialization code in the BIOS. 


Table 9-5 describes the various fields of the boot phase IPIs. 


Table 9-5. Boot Phase IPI Message Format 


Tune Destination Destination Trigger Destination Delivery Vector 
yp Field Shorthand Mode Level Mode Mode (Hex) 

BIPI Not used Allincluding self | Edge Deassert Don't Care Fixed 40 to 4€* 
(000) 

FIPI Not used Allincluding self | Edge Deassert Don't Care Fixed 10 
(000) 

SIPI Used All excluding self | Edge Assert Physical StartUp 00 to FF 
(110) 


NOTE: 
* For all P6 family processors. 


For BIPI messages, the lower 4 bits of the vector field contain the APIC ID of the processor issuing the message and 
the upper 4 bits contain the “generation ID” of the message. All P6 family processor will have a generation ID of 
4H. BIPIs will therefore use vector values ranging from 40H to 4EH (4FH can not be used because FH is not a valid 
APIC ID). 


9.11.2 MP Initialization Protocol Algorithm 


Following a power-up or RESET of a system, the P6 family processors in the system execute the MP initialization 
protocol algorithm to initialize each of the processors on the system bus. In the course of executing this algorithm, 
the following boot-up and initialization operations are carried out: 
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10. 


11. 


Each processor on the system bus is assigned a unique APIC ID, based on system topology (see Section 9.4.5, 
“Identifying Logical Processors in an MP System”). This ID is written into the local APIC ID register for each 
processor. 


Each processor executes its internal BIST simultaneously with the other processors on the system bus. Upon 
completion of the BIST (at TO), each processor broadcasts a BIPI to “all including self” (see Figure 9-8). 


APIC arbitration hardware causes all the APICs to respond to the BIPIs one at a time (at T1, T2, T3, and T4). 


When the first BIPI is received (at time T1), each APIC compares the four least significant bits of the BIPI’s 
vector field with its APIC ID. If the vector and APIC ID match, the processor selects itself as the BSP by setting 
the BSP flag in its IA32_APIC_BASE MSR. If the vector and APIC ID do not match, the processor selects itself 
as an AP by entering the “wait for SIPI” state. (Note that in Figure 9-8, the BIPI from processor 1 is the first 
BIPI to be handled, so processor 1 becomes the BSP.) 


The newly established BSP broadcasts an FIPI message to “all including self.” The FIPI is guaranteed to be 
handled only after the completion of the BIPIs that were issued by the non-BSP processors. 


System (CPU) Bus 


ak en a 


Pentium III Pentium III Pentium III Pentium III 
Processor 0 Processor 1 Processor 2 Processor 3 
APIC Bus 


Processor 1 

Becomes BSP 
TO T1 T2 T3 T4 T5 
A A A A A A 


BIPI.1 BIPI.0 BIPI.3 BIPI.2 FIPI 
Serial Bus Activity 


Figure 9-8. MP System With Multiple Pentium III Processors 


After the BSP has been established, the outstanding BIPIs are received one at a time (at T2, T3, and T4) and 
ignored by all processors. 


When the FIPI is finally received (at T5), only the BSP responds to it. It responds by fetching and executing 
BIOS boot-strap code, beginning at the reset vector (physical address FFFF FFFOH). 


As part of the boot-strap code, the BSP creates an ACPI table and an MP table and adds its initial APIC ID to 
these tables as appropriate. 


At the end of the boot-strap procedure, the BSP broadcasts a SIPI message to all the APs in the system. Here, 
the SIPI message contains a vector to the BIOS AP initialization code (at OOOV VOOOH, where VV is the vector 
contained in the SIPI message). 


All APs respond to the SIPI message by racing to a BIOS initialization semaphore. The first one to the 
semaphore begins executing the initialization code. (See MP init code for semaphore implementation details. ) 
As part of the AP initialization procedure, the AP adds its APIC ID number to the ACPI and MP tables as appro- 
priate. At the completion of the initialization procedure, the AP executes a CLI instruction (to clear the IF flag in 
the EFLAGS register) and halts itself. 


When each of the APs has gained access to the semaphore and executed the AP initialization code and all 
written their APIC IDs into the appropriate places in the ACPI and MP tables, the BSP establishes a count for the 
number of processors connected to the system bus, completes executing the BIOS boot-strap code, and then 
begins executing operating-system boot-strap and start-up code. 
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12. While the BSP is executing operating-system boot-strap and start-up code, the APs remain in the halted state. 
In this state they will respond only to INITs, NMIs, and SMIs. They will also respond to snoops and to assertions 
of the STPCLK# pin. 


See Section 9.4.4, “MP Initialization Example,” for an annotated example the use of the MP protocol to boot IA-32 
processors in an MP. This code should run on any IA-32 processor that used the MP protocol. 


9.11.2.1 Error Detection and Handling During the MP Initialization Protocol 


Errors may occur on the APIC bus during the MP initialization phase. These errors may be transient or permanent 
and can be caused by a variety of failure mechanisms (for example, broken traces, soft errors during bus usage, 
etc.). All serial bus related errors will result in an APIC checksum or acceptance error. 

The MP initialization protocol makes the following assumptions regarding errors that occur during initialization: 


¢ If errors are detected on the APIC bus during execution of the MP initialization protocol, the processors that 
detect the errors are shut down. 


¢ The MP initialization protocol will be executed by processors even if they fail their BIST sequences. 
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11.Updates to Chapter 12, Volume 3A 


Change bars and violet text show changes to Chapter 12 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3A: System Programming Guide, Part 1. 


Changes to this chapter: 


e Updates to Section 12.11.8, “MTRR Considerations in MP Systems,” and Section 12.12.4, “Programming the 
PAT.” 
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CHAPTER 12 
MEMORY CACHE CONTROL 


This chapter describes the memory cache and cache control mechanisms, the TLBs, and the store buffer in Intel 64 
and IA-32 processors. It also describes the memory type range registers (MTRRs) introduced in the P6 family 
processors and how they are used to control caching of physical memory locations. 


12.1. INTERNAL CACHES, TLBS, AND BUFFERS 


The Intel 64 and IA-32 architectures support cache, translation look aside buffers (TLBs), and a store buffer for 
temporary on-chip (and external) storage of instructions and data. (Figure 12-1 shows the arrangement of caches, 
TLBs, and the store buffer for the Pentium 4 and Intel Xeon processors.) Table 12-1 shows the characteristics of 
these caches and buffers for the Pentium 4, Intel Xeon, P6 family, and Pentium processors. The sizes and char- 
acteristics of these units are machine specific and may change in future versions of the processor. The 
CPUID instruction returns the sizes and characteristics of the caches and buffers for the processor on which the 
instruction is executed. See “CPUID—CPU Identification” in Chapter 3, “Instruction Set Reference, A-L,” of the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. 
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Figure 12-1. Cache Structure of the Pentium 4 and Intel Xeon Processors 
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Figure 12-2. Cache Structure of the Intel Core i7 Processors 


Figure 12-2 shows the cache arrangement of Intel Core i7 processor. 


Table 12-1. Characteristics of the Caches, TLBs, Store Buffer, and 
Write Combining Buffer in Intel 64 and IA-32 Processors 


Cache or Buffer 


Characteristics 


Trace Cache! 


« Pentium 4 and Intel Xeon processors (Based on Intel NetBurst® microarchitecture): 12 Kuwops, 8-way set 
associative. 

« Intel Core i7, Intel Core 2 Duo, Intel Atom, Intel Core Duo, Intel Core Solo, Pentium M processor: not 
implemented. 

= P6 family and Pentium processors: not implemented. 


L1 Instruction Cache 


« Pentium 4 and Intel Xeon processors (Based on Intel NetBurst microarchitecture): not implemented. 

« Intel Core i7 processor: 32-KByte, 4-way set associative. 

« Intel Core 2 Duo, Intel Atom, Intel Core Duo, Intel Core Solo, Pentium M processor: 32-KByte, 8-way set 
associative. 

= P6 family and Pentium processors: 8- or 16-KByte, 4-way set associative, 32-byte cache line size; 2-way set 
associative for earlier Pentium processors. 


L1 Data Cache 


* Pentium 4 and Intel Xeon processors (Based on Intel NetBurst microarchitecture): 8-KByte, 4-way set 
associative, 64-byte cache line size. 

* Pentium 4 and Intel Xeon processors (Based on Intel NetBurst microarchitecture): 16-KByte, 8-way set 
associative, 64-byte cache line size. 

« Intel Atom processors: 24-KByte, 6-way set associative, 64-byte cache line size. 

« Intel Core i7, Intel Core 2 Duo, Intel Core Duo, Intel Core Solo, Pentium M and Intel Xeon processors: 32- 
KByte, 8-way set associative, 64-byte cache line size. 

= P6 family processors: 16-KByte, 4-way set associative, 32-byte cache line size; 8-KBytes, 2-way set 
associative for earlier P6 family processors. 

« Pentium processors: 16-KByte, 4-way set associative, 32-byte cache line size; 8-KByte, 2-way set 
associative for earlier Pentium processors. 
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Table 12-1. Characteristics of the Caches, TLBs, Store Buffer, and 
Write Combining Buffer in Intel 64 and IA-32 Processors (Contd.) 


Cache or Buffer 


Characteristics 


L2 Unified Cache 


Intel Core 2 Duo and Intel Xeon processors: up to 4-MByte (or 4MBx2 in quadcore processors), 16-way set 
associative, 64-byte cache line size. 

Intel Core 2 Duo and Intel Xeon processors: up to 6-MByte (or 6MBx2 in quadcore processors), 24-way set 
associative, 64-byte cache line size. 

Intel Core i7, i5, i3 processors: 256KBbyte, 8-way set associative, 64-byte cache line size. 

Intel Atom processors: 512-KByte, 8-way set associative, 64-byte cache line size. 

Intel Core Duo, Intel Core Solo processors: 2-MByte, 8-way set associative, 64-byte cache line size 

Pentium 4 and Intel Xeon processors: 256, 512, 1024, or 2048-KByte, 8-way set associative, 64-byte cache 
line size, 128-byte sector size. 

Pentium M processor: 1 or 2-MByte, 8-way set associative, 64-byte cache line size. 

P6 family processors: 128-KByte, 256-KByte, 512-KByte, 1-MByte, or 2-MByte, 4-way set associative, 
32-byte cache line size. 

Pentium processor (external optional): System specific, typically 256- or 512-KByte, 4-way set associative, 
32-byte cache line size. 


L3 Unified Cache 


Intel Xeon processors: 512-KByte, 1-MByte, 2-MByte, or 4-MByte, 8-way set associative, 64-byte cache line 
size, 128-byte sector size. 

Intel Core i7 processor, Intel Xeon processor 5500: Up to 8MByte, 16-way set associative, 64-byte cache 
line size. 

Intel Xeon processor 5600: Up to 12MByte, 64-byte cache line size. 

Intel Xeon processor 7500: Up to 24MByte, 64-byte cache line size. 


Instruction TLB 
(4-KByte Pages) 


Pentium 4 and Intel Xeon processors (Based on Intel NetBurst microarchitecture): 128 entries, 4-way set 
associative. 

Intel Atom processors: 32-entries, fully associative. 

Intel Core i7, i5, i3 processors: 64-entries per thread (128-entries per core), 4-way set associative. 

Intel Core 2 Duo, Intel Core Duo, Intel Core Solo processors, Pentium M processor: 128 entries, 4-way set 
associative. 

P6 family processors: 32 entries, 4-way set associative. 

Pentium processor: 32 entries, 4-way set associative; fully set associative for Pentium processors with MMX 
technology. 


Data TLB (4-KByte 
Pages) 


« Intel Atom processors: 16-entry-per-thread micro-TLB, fully associative; 64-entry DTLB, 4-way set 


Intel Core i7, i5, i3 processors, DTLBO: 64-entries, 4-way set associative. 
Intel Core 2 Duo processors: DTLBO, 16 entries, DTLB1, 256 entries, 4 ways. 


associative; 16-entry PDE cache, fully associative. 

Pentium 4 and Intel Xeon processors (Based on Intel NetBurst microarchitecture): 64 entry, fully set 
associative, shared with large page DTLB. 

Intel Core Duo, Intel Core Solo processors, Pentium M processor: 128 entries, 4-way set associative. 
Pentium and P6 family processors: 64 entries, 4-way set associative; fully set, associative for Pentium 
processors with MMX technology. 


Instruction TLB 
(Large Pages) 


Intel Core i7, i5, i3 processors: 7-entries per thread, fully associative. 

Intel Core 2 Duo processors: 4 entries, 4 ways. 

Pentium 4 and Intel Xeon processors: large pages are fragmented. 

Intel Core Duo, Intel Core Solo, Pentium M processor: 2 entries, fully associative. 
P6 family processors: 2 entries, fully associative. 

Pentium processor: Uses same TLB as used for 4-KByte pages. 


Data TLB (Large 
Pages) 


Intel Core i7, i5, i3 processors, DTLBO: 32-entries, 4-way set associative. 

Intel Core 2 Duo processors: DTLBO, 16 entries, DTLB1, 32 entries, 4 ways. 

Intel Atom processors: 8 entries, 4-way set associative. 

Pentium 4 and Intel Xeon processors: 64 entries, fully set associative; shared with small page data TLBs. 
Intel Core Duo, Intel Core Solo, Pentium M processor: 8 entries, fully associative. 

P6 family processors: 8 entries, 4-way set associative. 

Pentium processor: 8 entries, 4-way set associative; uses same TLB as used for 4-KByte pages in Pentium 
processors with MMX technology. 


Second-level Unified 
TLB (4-KByte 
Pages) 


Intel Core i7, i5, i3 processor, STLB: 512-entries, 4-way set associative. 
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Table 12-1. Characteristics of the Caches, TLBs, Store Buffer, and 
Write Combining Buffer in Intel 64 and IA-32 Processors (Contd.) 


Cache or Buffer Characteristics 


Store Buffer 


« Intel Core i7, i5, i3 processors: 32entries. 

« Intel Core 2 Duo processors: 20 entries. 

« Intel Atom processors: 8 entries, used for both WC and store buffers. 

« Pentium 4 and Intel Xeon processors: 24 entries. 

« Pentium M processor: 16 entries. 

= P6 family processors: 12 entries. 

« Pentium processor: 2 buffers, 1 entry each (Pentium processors with MMX technology have 4 buffers for 4 


entries). 
Write Combining « Intel Core 2 Duo processors: 8 entries. 
(WC) Buffer « Intel Atom processors: 8 entries, used for both WC and store buffers. 
« Pentium 4 and Intel Xeon processors: 6 or 8 entries. 
« Intel Core Duo, Intel Core Solo, Pentium M processors: 6 entries. 
= P6 family processors: 4 entries. 
NOTES: 


1 Introduced to the IA-32 architecture in the Pentium 4 and Intel Xeon processors. 


Intel 64 and IA-32 processors may implement four types of caches: the trace cache, the level 1 (L1) cache, the 
level 2 (L2) cache, and the level 3 (L3) cache. See Figure 12-1. Cache availability is described below: 


Intel Core i7, i5, i3 processor family and Intel Xeon processor family based on Nehalem microarchi- 
tecture and Westmere microarchitecture — The L1 cache is divided into two sections: one section is 
dedicated to caching instructions (pre-decoded instructions) and the other caches data. The L2 cache is a 
unified data and instruction cache. Each processor core has its own Li and L2. The L3 cache is an inclusive, 
unified data and instruction cache, shared by all processor cores inside a physical package. No trace cache is 
implemented. 


Intel® Core™ 2 processor family and Intel® Xeon® processor family based on Intel® Core™ micro- 
architecture — The L1 cache is divided into two sections: one section is dedicated to caching instructions (pre- 
decoded instructions) and the other caches data. The L2 cache is a unified data and instruction cache located 
on the processor chip; it is shared between two processor cores in a dual-core processor implementation. 
Quad-core processors have two L2, each shared by two processor cores. No trace cache is implemented. 


Intel Atom® processor — The L1 cache is divided into two sections: one section is dedicated to caching 
instructions (pre-decoded instructions) and the other caches data. The L2 cache is a unified data and 
instruction cache is located on the processor chip. No trace cache is implemented. 


Intel® Core™ Solo and Intel® Core™ Duo processors — The L1 cache is divided into two sections: one 
section is dedicated to caching instructions (pre-decoded instructions) and the other caches data. The L2 cache 
is a unified data and instruction cache located on the processor chip. It is shared between two processor cores 
in a dual-core processor implementation. No trace cache is implemented. 


Pentium® 4 and Intel® Xeon® processors Based on Intel NetBurst® microarchitecture — The trace 

cache caches decoded instructions (uops) from the instruction decoder and the Li cache contains data. The L2 
and L3 caches are unified data and instruction caches located on the processor chip. Dualcore processors have 
two L2, one in each processor core. Note that the L3 cache is only implemented on some Intel Xeon processors. 


P6 family processors — The L1 cache is divided into two sections: one dedicated to caching instructions (pre- 
decoded instructions) and the other to caching data. The L2 cache is a unified data and instruction cache 
located on the processor chip. P6 family processors do not implement a trace cache. 


Pentium® processors — The L1 cache has the same structure as on P6 family processors. There is no trace 
cache. The L2 cache is a unified data and instruction cache external to the processor chip on earlier Pentium 
processors and implemented on the processor chip in later Pentium processors. For Pentium processors where 
the L2 cache is external to the processor, access to the cache is through the system bus. 


For Intel Core i7 processors and processors based on Intel Core, Intel Atom, and Intel NetBurst microarchitectures, 
Intel Core Duo, Intel Core Solo and Pentium M processors, the cache lines for the L1 and L2 caches (and L3 caches 
if supported) are 64 bytes wide. The processor always reads a cache line from system memory beginning on a 64- 
byte boundary. (A 64-byte aligned cache line begins at an address with its 6 least-significant bits clear.) A cache 
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line can be filled from memory with a 8-transfer burst transaction. The caches do not support partially-filled cache 
lines, so caching even a single doubleword requires caching an entire line. 


The Li and L2 cache lines in the P6 family and Pentium processors are 32 bytes wide, with cache line reads from 
system memory beginning on a 32-byte boundary (5 least-significant bits of a memory address clear.) A cache line 
can be filled from memory with a 4-transfer burst transaction. Partially-filled cache lines are not supported. 


The trace cache in processors based on Intel NetBurst microarchitecture is available in all execution modes: 
protected mode, system management mode (SMM), and real-address mode. The Li,L2, and L3 caches are also 
available in all execution modes; however, use of them must be handled carefully in SMM (see Section 32.4.2, 
“SMRAM Caching”). 


The TLBs store the most recently used page-directory and page-table entries. They speed up memory accesses 
when paging is enabled by reducing the number of memory accesses that are required to read the page tables 
stored in system memory. The TLBs are divided into four groups: instruction TLBs for 4-KByte pages, data TLBs for 
4-KByte pages; instruction TLBs for large pages (2-MByte, 4-MByte or 1-GByte pages), and data TLBs for large 
pages. The TLBs are normally active only in protected mode with paging enabled. When paging is disabled or the 
processor is in real-address mode, the TLBs maintain their contents until explicitly or implicitly flushed (see Section 
12.9, “Invalidating the Translation Lookaside Buffers (TLBs)”). 


Processors based on Intel Core microarchitectures implement one level of instruction TLB and two levels of data 
TLB. Intel Core i7 processor provides a second-level unified TLB. 


The store buffer is associated with the processors instruction execution units. It allows writes to system memory 
and/or the internal caches to be saved and in some cases combined to optimize the processor’s bus accesses. The 
store buffer is always enabled in all execution modes. 


The processor's caches are for the most part transparent to software. When enabled, instructions and data flow 
through these caches without the need for explicit software control. However, knowledge of the behavior of these 
caches may be useful in optimizing software performance. For example, knowledge of cache dimensions and 
replacement algorithms gives an indication of how large of a data structure can be operated on at once without 
causing cache thrashing. 


In multiprocessor systems, maintenance of cache consistency may, in rare circumstances, require intervention by 
system software. For these rare cases, the processor provides privileged cache control instructions for use in 
flushing caches and forcing memory ordering. 


There are several instructions that software can use to improve the performance of the Li, L2, and L3 caches, 
including the PREFETCHh, CLFLUSH, and CLFLUSHOPT instructions and the non-temporal move instructions 
(MOVNTI, MOVNTQ, MOVNTDQ, MOVNTPS, and MOVNTPD). The use of these instructions are discussed in Section 
12.5.5, “Cache Management Instructions.” 


12.2 CACHING TERMINOLOGY 


IA-32 processors (beginning with the Pentium processor) and Intel 64 processors use the MESI (modified, exclu- 
sive, shared, invalid) cache protocol to maintain consistency with internal caches and caches in other processors 
(see Section 12.4, “Cache Control Protocol”). 


When the processor recognizes that an operand being read from memory is cacheable, the processor reads an 
entire cache line into the appropriate cache (L1, L2, L3, or all). This operation is called a cache line fill. If the 
memory location containing that operand is still cached the next time the processor attempts to access the 
operand, the processor can read the operand from the cache instead of going back to memory. This operation is 
called a cache hit. 


When the processor attempts to write an operand to a cacheable area of memory, it first checks if a cache line for 
that memory location exists in the cache. If a valid cache line does exist, the processor (depending on the write 
policy currently in force) can write the operand into the cache instead of writing it out to system memory. This 
operation is called a write hit. If a write misses the cache (that is, a valid cache line is not present for area of 
memory being written to), the processor performs a cache line fill, write allocation. Then it writes the operand into 
the cache line and (depending on the write policy currently in force) can also write it out to memory. If the operand 
is to be written out to memory, it is written first into the store buffer, and then written from the store buffer to 
memory when the system bus is available. (Note that for the Pentium processor, write misses do not result in a 
cache line fill; they always result in a write to memory. For this processor, only read misses result in cache line fills.) 
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When operating in an MP system, IA-32 processors (beginning with the Intel486 processor) and Intel 64 processors 
have the ability to snoop other processor’s accesses to system memory and to their internal caches. They use this 
snooping ability to keep their internal caches consistent both with system memory and with the caches in other 
processors on the bus. For example, in the Pentium and P6 family processors, if through snooping one processor 
detects that another processor intends to write to a memory location that it currently has cached in shared state, 
the snooping processor will invalidate its cache line forcing it to perform a cache line fill the next time it accesses 
the same memory location. 


Beginning with the P6 family processors, if a processor detects (through snooping) that another processor is trying 
to access a memory location that it has modified in its cache, but has not yet written back to system memory, the 
snooping processor will signal the other processor (by means of the HITM# signal) that the cache line is held in 
modified state and will perform an implicit write-back of the modified data. The implicit write-back is transferred 
directly to the initial requesting processor and snooped by the memory controller to assure that system memory 
has been updated. Here, the processor with the valid data may pass the data to the other processors without actu- 
ally writing it to system memory; however, it is the responsibility of the memory controller to snoop this operation 
and update memory. 


12.3. METHODS OF CACHING AVAILABLE 


The processor allows any area of system memory to be cached in the L1, L2, and L3 caches. In individual pages or 
regions of system memory, it allows the type of caching (also called memory type) to be specified (see Section 
12.5). Memory types currently defined for the Intel 64 and IA-32 architectures are (see Table 12-2): 


* Strong Uncacheable (UC) —System memory locations are not cached. All reads and writes appear on the 
system bus and are executed in program order without reordering. No speculative memory accesses, page- 
table walks, or prefetches of speculated branch targets are made. This type of cache-control is useful for 
memory-mapped I/O devices. When used with normal RAM, it greatly reduces processor performance. 


NOTE 


The behavior of x87 and SIMD instructions referencing memory is implementation dependent. In 
some implementations, accesses to UC memory may occur more than once. To ensure predictable 
behavior, use loads and stores of general purpose registers to access UC memory that may have 
read or write side effects. 


Table 12-2. Memory Types and Their Properties 


Memory Type and | Cacheable | Writeback | Allows Memory Ordering Model 
Mnemonic Cacheable | Speculative 
Reads 
Strong Uncacheable | No No No Strong Ordering 
(UC) 
Uncacheable (UC-) No No No Strong Ordering. Can only be selected through the PAT. Can be 
overridden by WC in MTRRs. 
Write Combining (WC) | No No Yes Weak Ordering. Available by programming MTRRs or by selecting it 
through the PAT. 
Write Through (WT) | Yes No Yes Speculative Processor Ordering. 
Write Back (WB) Yes Yes Yes Speculative Processor Ordering. 
Write Protected (WP) | Yes for No Yes Speculative Processor Ordering. Available by programming MTRRs. 
reads; no for 
writes 


¢ Uncacheable (UC-) — Has same characteristics as the strong uncacheable (UC) memory type, except that 
this memory type can be overridden by programming the MTRRs for the WC memory type. This memory type 
is available in processor families starting from the Pentium III processors and can only be selected through the 
PAT. 
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¢ Write Combining (WC) — System memory locations are not cached (as with uncacheable memory) and 

coherency is not enforced by the processor’s bus coherency protocol. Speculative reads are allowed. Writes 
may be delayed and combined in the write combining buffer (WC buffer) to reduce memory accesses. If the WC 
buffer is partially filled, the writes may be delayed until the next occurrence of a serializing event; such as an 
SFENCE or MFENCE instruction, CPUID or other serializing instruction, a read or write to uncached memory, an 
interrupt occurrence, or an execution of a LOCK instruction (including one with an XACQUIRE or XRELEASE 
prefix). In addition, an execution of the XEND instruction (to end a transactional region) evicts any writes that 
were buffered before the corresponding execution of the XBEGIN instruction (to begin the transactional region) 
before evicting any writes that were performed inside the transactional region. 


This type of cache-control is appropriate for video frame buffers, where the order of writes is unimportant as 
long as the writes update memory so they can be seen on the graphics display. See Section 12.3.1, “Buffering 
of Write Combining Memory Locations,” for more information about caching the WC memory type. This memory 
type is available in the Pentium Pro and Pentium II processors by programming the MTRRs; or in processor 
families starting from the Pentium III processors by programming the MTRRs or by selecting it through the PAT. 


° Write-through (WT) — Writes and reads to and from system memory are cached. Reads come from cache 
lines on cache hits; read misses cause cache fills. Speculative reads are allowed. All writes are written to a 
cache line (when possible) and through to system memory. When writing through to memory, invalid cache 
lines are never filled, and valid cache lines are either filled or invalidated. Write combining is allowed. This type 
of cache-control is appropriate for frame buffers or when there are devices on the system bus that access 
system memory, but do not perform snooping of memory accesses. It enforces coherency between caches in 
the processors and system memory. 


¢ Write-back (WB) — Writes and reads to and from system memory are cached. Reads come from cache lines 
on cache hits; read misses cause cache fills. Speculative reads are allowed. Write misses cause cache line fills 
(in processor families starting with the P6 family processors), and writes are performed entirely in the cache, 
when possible. Write combining is allowed. The write-back memory type reduces bus traffic by eliminating 
many unnecessary writes to system memory. Writes to a cache line are not immediately forwarded to system 
memory; instead, they are accumulated in the cache. The modified cache lines are written to system memory 
later, when a write-back operation is performed. Write-back operations are triggered when cache lines need to 
be deallocated, such as when new cache lines are being allocated in a cache that is already full. They also are 
triggered by the mechanisms used to maintain cache consistency. This type of cache-control provides the best 
performance, but it requires that all devices that access system memory on the system bus be able to snoop 
memory accesses to ensure system memory and cache coherency. 


¢ Write protected (WP) — Reads come from cache lines when possible, and read misses cause cache fills. 
Writes are propagated to the system bus and cause corresponding cache lines on all processors on the bus to 
be invalidated. Speculative reads are allowed. This memory type is available in processor families starting from 
the P6 family processors by programming the MTRRs (see Table 12-6). 


Table 12-3 shows which of these caching methods are available in the Pentium, P6 Family, Pentium 4, and Intel 
Xeon processors. 


Table 12-3. Methods of Caching Available in Intel Core 2 Duo, Intel Atom, Intel Core Duo, Pentium M, Pentium 4, 
Intel Xeon, P6 Family, and Pentium Processors 


Memory Type Intel Core 2 Duo, Intel Atom, Intel Core Duo, P6 Family Pentium 
Pentium M, Pentium 4 and Intel Xeon Processors | Processors Processor 

Strong Uncacheable (UC) Yes Yes Yes 
Uncacheable (UC-) Yes Yes* No 

Write Combining (WC) Yes Yes No 

Write Through (WT) Yes Yes Yes 

Write Back (WB) Yes Yes Yes 

Write Protected (WP) Yes Yes No 

NOTE: 


* Introduced in the Pentium Ill processor; not available in the Pentium Pro or Pentium II processors 
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12.3.1 Buffering of Write Combining Memory Locations 


Writes to the WC memory type are not cached in the typical sense of the word cached. They are retained in an 
internal write combining buffer (WC buffer) that is separate from the internal L1, L2, and L3 caches and the store 
buffer. The WC buffer is not snooped and thus does not provide data coherency. Buffering of writes to WC memory 
is done to allow software a small window of time to supply more modified data to the WC buffer while remaining as 
non-intrusive to software as possible. The buffering of writes to WC memory also causes data to be collapsed; that 
is, multiple writes to the same memory location will leave the last data written in the location and the other writes 
will be lost. 


The size and structure of the WC buffer is not architecturally defined. For the Intel Core 2 Duo, Intel Atom, Intel 
Core Duo, Pentium M, Pentium 4 and Intel Xeon processors; the WC buffer is made up of several 64-byte WC 
buffers. For the P6 family processors, the WC buffer is made up of several 32-byte WC buffers. 


When software begins writing to WC memory, the processor begins filling the WC buffers one at a time. When one 
or more WC buffers has been filled, the processor has the option of evicting the buffers to system memory. The 
protocol for evicting the WC buffers is implementation dependent and should not be relied on by software for 
system memory coherency. When using the WC memory type, software must be sensitive to the fact that the 
writing of data to system memory is being delayed and must deliberately empty the WC buffers when system 
memory coherency is required. 


Once the processor has started to evict data from the WC buffer into system memory, it will make a bus-transaction 
style decision based on how much of the buffer contains valid data. If the buffer is full (for example, all bytes are 
valid), the processor will execute a burst-write transaction on the bus. This results in all 32 bytes (P6 family proces- 
sors) or 64 bytes (Pentium 4 and more recent processor) being transmitted on the data bus in a single burst trans- 
action. If one or more of the WC buffer’s bytes are invalid (for example, have not been written by software), the 
processor will transmit the data to memory using “partial write” transactions (one chunk at a time, where a “chunk” 
is 8 bytes). 


This will result in a maximum of 4 partial write transactions (for P6 family processors) or 8 partial write transactions 
(for the Pentium 4 and more recent processors) for one WC buffer of data sent to memory. 


The WC memory type is weakly ordered by definition. Once the eviction of a WC buffer has started, the data is 
subject to the weak ordering semantics of its definition. Ordering is not maintained between the successive alloca- 
tion/deallocation of WC buffers (for example, writes to WC buffer 1 followed by writes to WC buffer 2 may appear 
as buffer 2 followed by buffer 1 on the system bus). When a WC buffer is evicted to memory as partial writes there 
is no guaranteed ordering between successive partial writes (for example, a partial write for chunk 2 may appear 
on the bus before the partial write for chunk 1 or vice versa). 


The only elements of WC propagation to the system bus that are guaranteed are those provided by transaction 
atomicity. For example, with a P6 family processor, a completely full WC buffer will always be propagated as a 
single 32-bit burst transaction using any chunk order. In a WC buffer eviction where data will be evicted as partials, 
all data contained in the same chunk (0 mod 8 aligned) will be propagated simultaneously. Likewise, for more 
recent processors starting with those based on Intel NetBurst microarchitectures, a full WC buffer will always be 
propagated as a single burst transactions, using any chunk order within a transaction. For partial buffer propaga- 
tions, all data contained in the same chunk will be propagated simultaneously. 


12.3.2 Choosing a Memory Type 


The simplest system memory model does not use memory-mapped I/O with read or write side effects, does not 
include a frame buffer, and uses the write-back memory type for all memory. An I/O agent can perform direct 
memory access (DMA) to write-back memory and the cache protocol maintains cache coherency. 


A system can use strong uncacheable memory for other memory-mapped I/O, and should always use strong unca- 
cheable memory for memory-mapped I/O with read side effects. 


Dual-ported memory can be considered a write side effect, making relatively prompt writes desirable, because 
those writes cannot be observed at the other port until they reach the memory agent. A system can use strong 
uncacheable, uncacheable, write-through, or write-combining memory for frame buffers or dual-ported memory 
that contains pixel values displayed on a screen. Frame buffer memory is typically large (a few megabytes) and is 
usually written more than it is read by the processor. Using strong uncacheable memory for a frame buffer gener- 
ates very large amounts of bus traffic, because operations on the entire buffer are implemented using partial writes 
rather than line writes. Using write-through memory for a frame buffer can displace almost all other useful cached 
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lines in the processor's L2 and L3 caches and L1 data cache. Therefore, systems should use write-combining 
memory for frame buffers whenever possible. 


Software can use page-level cache control, to assign appropriate effective memory types when software will not 
access data structures in ways that benefit from write-back caching. For example, software may read a large data 
structure once and not access the structure again until the structure is rewritten by another agent. Such a large 
data structure should be marked as uncacheable, or reading it will evict cached lines that the processor will be 
referencing again. 


A similar example would be a write-only data structure that is written to (to export the data to another agent), but 
never read by software. Such a structure can be marked as uncacheable, because software never reads the values 
that it writes (though as uncacheable memory, it will be written using partial writes, while as write-back memory, 
it will be written using line writes, which may not occur until the other agent reads the structure and triggers 
implicit write-backs). 


On the Pentium Ill, Pentium 4, and more recent processors, new instructions are provided that give software 
greater control over the caching, prefetching, and the write-back characteristics of data. These instructions allow 
software to use weakly ordered or processor ordered memory types to improve processor performance, but when 
necessary to force strong ordering on memory reads and/or writes. They also allow software greater control over 
the caching of data. For a description of these instructions and their intended use, see Section 12.5.5, “Cache 
Management Instructions.” 


12.3.3. Code Fetches in Uncacheable Memory 


Programs may execute code from uncacheable (UC) memory, but the implications are different from accessing 
data in UC memory. When doing code fetches, the processor never transitions from cacheable code to UC code 
speculatively. It also never speculatively fetches branch targets that result in UC code. 


The processor may fetch the same UC cache line multiple times in order to decode an instruction once. It may 

decode consecutive UC instructions in a cache line without fetching between each instruction. It may also fetch 
additional cachelines from the same or a consecutive 4-KByte page in order to decode one non-speculative UC 
instruction (this can be true even when the instruction is contained fully in one line). 


Because of the above and because cache line sizes may change in future processors, software should avoid placing 
memory-mapped I/O with read side effects in the same page or in a subsequent page used to execute UC code. 


12.4 CACHE CONTROL PROTOCOL 


The following section describes the cache control protocol currently defined for the Intel 64 and IA-32 architec- 
tures. 


In the Li data cache and in the L2/L3 unified caches, the MESI (modified, exclusive, shared, invalid) cache protocol 
maintains consistency with caches of other processors. The L1 data cache and the L2/L3 unified caches have two 
MESI status flags per cache line. Each line can be marked as being in one of the states defined in Table 12-4. In 
general, the operation of the MESI protocol is transparent to programs. 


Table 12-4. MESI Cache Line States 


Cache Line State M (Modified) E (Exclusive) S (Shared) I (Invalid) 
This cache line is valid? Yes Yes Yes No 
The memory copy is... Out of date Valid Valid - 
Copies exist in caches of other | No No Maybe Maybe 
processors? 
A write to this line ... Does not go to the Does not go to the Causes the processor to Goes directly to the 
system bus. system bus. gain exclusive ownership | system bus. 
of the line. 
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The L1 instruction cache in P6 family processors implements only the “SI” part of the MESI protocol, because the 
instruction cache is not writable. The instruction cache monitors changes in the data cache to maintain consistency 
between the caches when instructions are modified. See Section 12.6, “Self-Modifying Code,” for more information 
on the implications of caching instructions. 


12.5 CACHE CONTROL 


The Intel 64 and IA-32 architectures provide a variety of mechanisms for controlling the caching of data and 
instructions and for controlling the ordering of reads and writes between the processor, the caches, and memory. 
These mechanisms can be divided into two groups: 


¢ Cache control registers and bits — The Intel 64 and IA-32 architectures define several dedicated registers 
and various bits within control registers and page- and directory-table entries that control the caching system 
memory locations in the L1, L2, and L3 caches. These mechanisms control the caching of virtual memory pages 
and of regions of physical memory. 


° Cache control and memory ordering instructions — The Intel 64 and IA-32 architectures provide several 
instructions that control the caching of data, the ordering of memory reads and writes, and the prefetching of 
data. These instructions allow software to control the caching of specific data structures, to control memory 
coherency for specific locations in memory, and to force strong memory ordering at specific locations in a 
program. 


The following sections describe these two groups of cache control mechanisms. 


12.5.1. Cache Control Registers and Bits 


Figure 12-3 depicts cache-control mechanisms in IA-32 processors. Other than for the matter of memory address 
space, these work the same in Intel 64 processors. 


The Intel 64 and IA-32 architectures provide the following cache-control registers and bits for use in enabling or 
restricting caching to various pages or regions in memory: 


° CD flag, bit 30 of control register CRO — Controls caching of system memory locations (see Section 2.5, 
“Control Registers”). If the CD flag is clear, caching is enabled for the whole of system memory, but may be 
restricted for individual pages or regions of memory by other cache-control mechanisms. When the CD flag is 
set, caching is restricted in the processor’s caches (cache hierarchy) for the P6 and more recent processor 
families and prevented for the Pentium processor (see note below). With the CD flag set, however, the caches 
will still respond to snoop traffic. Caches should be explicitly flushed to ensure memory coherency. For highest 
processor performance, both the CD and the NW flags in control register CRO should be cleared. Table 12-5 
shows the interaction of the CD and NW flags. 


The effect of setting the CD flag is somewhat different for processor families starting with P6 family than the 
Pentium processor (see Table 12-5). To ensure memory coherency after the CD flag is set, the caches should 
be explicitly flushed (see Section 12.5.3, “Preventing Caching”). Setting the CD flag for the P6 and more 
recent processor families modifies cache line fill and update behavior. Also, setting the CD flag on these 
processors do not force strict ordering of memory accesses unless the MTRRs are disabled and/or all memory 
is referenced as uncached (see Section 9.2.5, “Strengthening or Weakening the Memory-Ordering Model”). 
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1. G flag only available in P6 and later processor families 

2. The maximum physical address size is reported by CPUID leaf 
function 80000008H. The maximum physical address size of 
FFFFFFFFFH applies only If 36-bit physical addressing is used. 

3. MTRRs available only in P6 and later processor families; 
similar control available in Pentium processor with the KEN# 
and WB/WT# pins. 

4. PAT available only in Pentium III and later processor families. 

5. L3 in processors based on Intel NetBurst microarchitecture can 
be disabled using IA32_MISC_ENABLE MSR. 


Figure 12-3. Cache-Control Registers and Bits Available in Intel 64 and IA-32 Processors 
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Table 12-5. Cache Operating Modes 


CD | NW Caching and Read/Write Policy 1 L2/.3! 
0 Q | Normal Cache Mode. Highest performance cache operation. 
» Read hits access the cache; read misses may cause replacement. Yes Yes 
« Write hits update the cache. Yes Yes 
* Only writes to shared lines and write misses update system memory. Yes Yes 
« Write misses cause cache line fills. Yes Yes 
« Write hits can change shared lines to modified under control of the MTRRs and with associated Yes 
read invalidation cycle. 
* (Pentium processor only.) Write misses do not cause cache line fills. Yes 
« (Pentium processor only.) Write hits can change shared lines to exclusive under control of WB/WT#.| Yes 
* Invalidation is allowed. 
* €xternal snoop traffic is supported. Yes Yes 
Yes Yes 
0 1 | Invalid setting. 
Generates a general-protection exception (HGP) with an error code of 0. NA NA 
1 QO | No-fill Cache Mode. Memory coherency is maintained.? 
« (Pentium 4 and later processor families.) State of processor after a power up or reset. Yes Yes 
« Read hits access the cache; read misses do not cause replacement (see Pentium 4 and Intel Xeon 
processors reference below). Yes Yes 
« Write hits update the cache. 
* Only writes to shared lines and write misses update system memory. 
Yes Yes 
Yes Yes 
« Write misses access memory. Yes Yes 
« Write hits can change shared lines to exclusive under control of the MTRRs and with associated Yes Yes 
read invalidation cycle. 
* (Pentium processor only.) Write hits can change shared lines to exclusive under control of the Yes 
WB/WT#. 
« (P6 and later processor families only.) Strict memory ordering is not enforced unless the MTRRs are | Yes Yes 
disabled and/or all memory is referenced as uncached (see Section 7.2.4., “Strengthening or 
Weakening the Memory Ordering Model’). 
* Invalidation is allowed. 
* External snoop traffic is supported. Yes Yes 
Yes Yes 
1 1 | Memory coherency is not maintained.” 3 
« (P6 family and Pentium processors.) State of the processor after a power up or reset. Yes Yes 
« Read hits access the cache; read misses do not cause replacement. 
« Write hits update the cache and change exclusive lines to modified. Yes Yes 
Yes Yes 
» Shared lines remain shared after write hit. Yes Yes 
« Write misses access memory. Yes Yes 
*  Invalidation is inhibited when snooping; but is allowed with INVD and WBINVD instructions. Yes Yes 
« €xternal snoop traffic is supported. 
No Yes 


NOTES: 


1. The L2/L3 column in this table is definitive for the Pentium 4, Intel Xeon, and P6 family processors. It is intended to represent what 


could be implemented in a system based on a Pentium processor with an external, platform specific, write-back L2 cache. 


2. The Pentium 4 and more recent processor families do not support this mode; setting the CD and NW bits to 1 selects the no-fill 


cache mode. 


3. Not supported In Intel Atom processors. If CD = 1 in an Intel Atom processor, caching is disabled. 
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NW flag, bit 29 of control register CRO — Controls the write policy for system memory locations (see 
Section 2.5, “Control Registers”). If the NW and CD flags are clear, write-back is enabled for the whole of 
system memory, but may be restricted for individual pages or regions of memory by other cache-control 
mechanisms. Table 12-5 shows how the other combinations of CD and NW flags affects caching. 


NOTES 


For the Pentium 4 and Intel Xeon processors, the NW flag is a don’t care flag; that is, when the CD 
flag is set, the processor uses the no-fill cache mode, regardless of the setting of the NW flag. 


For Intel Atom processors, the NW flag is a don’t care flag; that is, when the CD flag is set, the 
processor disables caching, regardless of the setting of the NW flag. 


For the Pentium processor, when the L1 cache is disabled (the CD and NW flags in control register 
CRO are set), external snoops are accepted in DP (dual-processor) systems and inhibited in unipro- 
cessor systems. 


When snoops are inhibited, address parity is not checked and APCHK# is not asserted for a corrupt 
address; however, when snoops are accepted, address parity is checked and APCHK# is asserted 
for corrupt addresses. 


PCD and PWT flags in paging-structure entries — Control the memory type used to access paging 
structures and pages (see Section 4.9, “Paging and Memory Typing”). 


PCD and PWT flags in control register CR3 — Control the memory type used to access the first paging 
structure of the current paging-structure hierarchy (see Section 4.9, “Paging and Memory Typing”). 


G (global) flag in the page-directory and page-table entries (introduced to the IA-32 architecture in 
the P6 family processors) — Controls the flushing of TLB entries for individual pages. See Section 4.10, 
“Caching Translation Information,” for more information about this flag. 


PGE (page global enable) flag in control register CR4 — Enables the establishment of global pages with 
the G flag. See Section 4.10, “Caching Translation Information,” for more information about this flag. 


Memory type range registers (MTRRs) (introduced in P6 family processors) — Control the type of 
caching used in specific regions of physical memory. Any of the caching types described in Section 12.3, 
“Methods of Caching Available,” can be selected. See Section 12.11, ‘Memory Type Range Registers (MTRRs),” 
for a detailed description of the MTRRs. 


Page Attribute Table (PAT) MSR (introduced in the Pentium Ill processor) — Extends the memory 
typing capabilities of the processor to permit memory types to be assigned on a page-by-page basis (see 
Section 12.12, “Page Attribute Table (PAT)”). 


Third-Level Cache Disable flag, bit 6 of the IA32_MISC_ENABLE MSR (Available only in processors 
based on Intel NetBurst microarchitecture) — Allows the L3 cache to be disabled and enabled, indepen- 
dently of the L1 and L2 caches. 


KEN# and WB/WT# pins (Pentium processor) — Allow external hardware to control the caching method 
used for specific areas of memory. They perform similar (but not identical) functions to the MTRRs in the P6 
family processors. 


PCD and PWT pins (Pentium processor) — These pins (which are associated with the PCD and PWT flags in 
control register CR3 and in the page-directory and page-table entries) permit caching in an external L2 cache 
to be controlled on a page-by-page basis, consistent with the control exercised on the L1 cache of these 
processors. The P6 and more recent processor families do not provide these pins because the L2 cache in 
internal to the chip package. 


12.5.2 Precedence of Cache Controls 


The cache control flags and MTRRs operate hierarchically for restricting caching. That is, if the CD flag is set, 

caching is prevented globally (see Table 12-5). If the CD flag is clear, the page-level cache control flags and/or the 
MTRRs can be used to restrict caching. If there is an overlap of page-level and MTRR caching controls, the mecha- 
nism that prevents caching has precedence. For example, if an MTRR makes a region of system memory uncache- 
able, a page-level caching control cannot be used to enable caching for a page in that region. The converse is also 
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true; that is, if a page-level caching control designates a page as uncacheable, an MTRR cannot be used to make 
the page cacheable. 


In cases where there is a overlap in the assignment of the write-back and write-through caching policies to a page 
and a region of memory, the write-through policy takes precedence. The write-combining policy (which can only be 
assigned through an MTRR or the PAT) takes precedence over either write-through or write-back. 


The selection of memory types at the page level varies depending on whether PAT is being used to select memory 
types for pages, as described in the following sections. 


On processors based on Intel NetBurst microarchitecture, the third-level cache can be disabled by bit 6 of the 
IA32_MISC_ENABLE MSR. Using IA32_MISC_ENABLE[bit 6] takes precedence over the CD flag, MTRRs, and PAT 
for the L3 cache in those processors. That is, when the third-level cache disable flag is set (cache disabled), the 
other cache controls have no affect on the L3 cache; when the flag is clear (enabled), the cache controls have the 
same affect on the L3 cache as they have on the L1 and L2 caches. 


IA32_MISC_ENABLE[bit 6] is not supported in Intel Core i7 processors, nor processors based on Intel Core, and 
Intel Atom microarchitectures. 


12.5.2.1 Selecting Memory Types for Pentium Pro and Pentium II Processors 


The Pentium Pro and Pentium II processors do not support the PAT. Here, the effective memory type for a page is 
selected with the MTRRs and the PCD and PWT bits in the page-table or page-directory entry for the page. Table 
12-6 describes the mapping of MTRR memory types and page-level caching attributes to effective memory types, 
when normal caching is in effect (the CD and NW flags in control register CRO are clear). Combinations that appear 
in gray are implementation-defined for the Pentium Pro and Pentium II processors. System designers are encour- 
aged to avoid these implementation-defined combinations. 


Table 12-6. Effective Page-Level Memory Type for Pentium Pro and Pentium II Processors 


MTRR Memory Type! PCD Value PWT Value Effective Memory Type 
UC X X UC 
WC 0 0 wC 
0 1 WC 
1 0 WC 
1 1 UC 
WT 0 xX WT 
1 X UC 
WP 0 0 WP 
0 1 WP 
1 0 WC 
1 1 UC 
WB 0 0 WB 
0 1 WT 
1 X UC 
NOTE: 


1. These effective memory types also apply to the Pentium 4, Intel Xeon, and Pentium Ill processors when the PAT bit is not used 
(set to 0) in page-table and page-directory entries. 


When normal caching is in effect, the effective memory type shown in Table 12-6 is determined using the following 
rules: 


1. If the PCD and PWT attributes for the page are both O, then the effective memory type is identical to the 
MTRR-defined memory type. 
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If the PCD flag is set, then the effective memory type is UC. 


If the PCD flag is clear and the PWT flag is set, the effective memory type is WT for the WB memory type and 
the MTRR-defined memory type for all other memory types. 


4. Setting the PCD and PWT flags to opposite values is considered model-specific for the WP and WC memory 
types and architecturally-defined for the WB, WT, and UC memory types. 


12.5.2.2 Selecting Memory Types for Pentium Ill and More Recent Processor Families 


The Intel Core 2 Duo, Intel Atom, Intel Core Duo, Intel Core Solo, Pentium M, Pentium 4, Intel Xeon, and Pentium 
lll processors use the PAT to select effective page-level memory types. Here, a memory type for a page is selected 
by the MTRRs and the value in a PAT entry that is selected with the PAT, PCD, and PWT bits in a page-table or page- 
directory entry (see Section 12.12.3, “Selecting a Memory Type from the PAT”). Table 12-7 describes the mapping 
of MTRR memory types and PAT entry types to effective memory types, when normal caching is in effect (the CD 
and NW flags in control register CRO are clear). 


Table 12-7. Effective Page-Level Memory Types for Pentium III and More Recent Processor Families 


MTRR Memory Type PAT Entry Value Effective Memory Type 
UC UC uc! 
UC- uc! 
Wc wc 
WT UCT 
WB uc! 
WP uc! 
WC UC UCZ 
UC- wc 
WC wc 
WT uc#3 
WB wc 
WP uc#3 
WT UC We 
UC- UC2 
Wc wc 
WT WT 
WB WT 
WP wp? 
WB UC UCZ 
UC- UCZ 
Wc wc 
WT WT 
WB WB 
WP WP 
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Table 12-7. Effective Page-Level Memory Types for Pentium Ill and More Recent Processor Families (Contd.) 


MTRR Memory Type PAT Entry Value Effective Memory Type 
WP UC UC? 
UC- we 
WC WC 
WT wT? 
WB WP 
WP WP 


NOTES: 

1. The UC attribute comes from the MTRRs and the processors are not required to snoop their caches since the data could never have 
been cached. This attribute is preferred for performance reasons. 

2. The UC attribute came from the page-table or page-directory entry and processors are required to check their caches because the 
data may be cached due to page aliasing, which is not recommended. 

3. These combinations were specified as “undefined” in previous editions of the Intel® 64 and IA-32 Architectures Software Devel- 
oper’s Manual. However, all processors that support both the PAT and the MTRRs determine the effective page-level memory 
types for these combinations as given. 


12.5.2.3. Writing Values Across Pages with Different Memory Types 


If two adjoining pages in memory have different memory types, and a word or longer operand is written to a 
memory location that crosses the page boundary between those two pages, the operand might be written to 
memory twice. This action does not present a problem for writes to actual memory; however, if a device is mapped 
to the memory space assigned to the pages, the device might malfunction. 


12.5.3. Preventing Caching 


To disable the L1, L2, and L3 caches after they have been enabled and have received cache fills, perform the 
following steps: 


1. Enter the no-fill cache mode. (Set the CD flag in control register CRO to 1 and the NW flag to 0. 
2. Flush all caches using the WBINVD instruction. 


3. Disable the MTRRs and set the default memory type to uncached or set all MTRRs for the uncached memory 
type (see the discussion of the discussion of the TYPE field and the E flag in Section 12.11.2.1, “IA32_MTR- 
R_DEF_TYPE MSR"). 


The caches must be flushed (step 2) after the CD flag is set to ensure system memory coherency. If the caches are 
not flushed, cache hits on reads will still occur and data will be read from valid cache lines. 


The intent of the three separate steps listed above address three distinct requirements: (i) discontinue new data 
replacing existing data in the cache (ii) ensure data already in the cache are evicted to memory, (iii) ensure subse- 
quent memory references observe UC memory type semantics. Different processor implementation of caching 
control hardware may allow some variation of software implementation of these three requirements. See note 
below. 


NOTES 


Setting the CD flag in control register CRO modifies the processor’s caching behavior as indicated in 
Table 12-5, but setting the CD flag alone may not be sufficient across all processor families to force 
the effective memory type for all physical memory to be UC nor does it force strict memory 
ordering, due to hardware implementation variations across different processor families. To force 
the UC memory type and strict memory ordering on all of physical memory, it is sufficient to either 
program the MTRRs for all physical memory to be UC memory type or disable all MTRRs. 


For the Pentium 4 and Intel Xeon processors, after the sequence of steps given above has been 
executed, the cache lines containing the code between the end of the WBINVD instruction and 
before the MTRRS have actually been disabled may be retained in the cache hierarchy. Here, to 
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remove code from the cache completely, a second WBINVD instruction must be executed after the 
MTRRs have been disabled. 


For Intel Atom processors, setting the CD flag forces all physical memory to observe UC semantics 
(without requiring memory type of physical memory to be set explicitly). Consequently, software 
does not need to issue a second WBINVD as some other processor generations might require. 


12.5.4 Disabling and Enabling the L3 Cache 


On processors based on Intel NetBurst microarchitecture, the third-level cache can be disabled by bit 6 of the 
IA32_MISC_ENABLE MSR. The third-level cache disable flag (bit 6 of the IA32_MISC_ENABLE MSR) allows the L3 
cache to be disabled and enabled, independently of the L1 and L2 caches. Prior to using this control to disable or 
enable the L3 cache, software should disable and flush all the processor caches, as described earlier in Section 
12.5.3, “Preventing Caching,” to prevent of loss of information stored in the L3 cache. After the L3 cache has been 
disabled or enabled, caching for the whole processor can be restored. 


Newer Intel 64 processor with L3 do not support IA32_MISC_ENABLE[bit 6], the procedure described in Section 
12.5.3, “Preventing Caching,” apply to the entire cache hierarchy. 


12.5.5 Cache Management Instructions 


The Intel 64 and IA-32 architectures provide several instructions for managing the Li, L2, and L3 caches. The INVD 
and WBINVD instructions are privileged instructions and operate on the Li, L2, and L3 caches as a whole. The 
PREFETCHh, CLFLUSH, and CLFLUSHOPT instructions and the non-temporal move instructions (MOVNTI, MOVNTQ, 
MOVNTDQ, MOVNTPS, and MOVNTPD) offer more granular control over caching, and are available to all privileged 
levels. 


The INVD and WBINVD instructions are used to invalidate the contents of the L1, L2, and L3 caches. The INVD 
instruction invalidates all internal cache entries, then generates a special-function bus cycle that indicates that 
external caches also should be invalidated. The INVD instruction should be used with care. It does not force a 
write-back of modified cache lines; therefore, data stored in the caches and not written back to system memory 
will be lost. Unless there is a specific requirement or benefit to invalidating the caches without writing back the 
modified lines (such as, during testing or fault recovery where cache coherency with main memory is not a 
concern), software should use the WBINVD instruction. 


The WBINVD instruction first writes back any modified lines in all the internal caches, then invalidates the contents 
of the L1, L2, and L3 caches. It ensures that cache coherency with main memory is maintained regardless of the 
write policy in effect (that is, write-through or write-back). Following this operation, the WBINVD instruction gener- 
ates one (P6 family processors) or two (Pentium and Intel486 processors) special-function bus cycles to indicate to 
external cache controllers that write-back of modified data followed by invalidation of external caches should occur. 
The amount of time or cycles for WBINVD to complete will vary due to the size of different cache hierarchies and 
other factors. As a consequence, the use of the WBINVD instruction can have an impact on interrupt/event 
response time. 


The PREFETCHA instructions allow a program to suggest to the processor that a cache line from a specified location 
in system memory be prefetched into the cache hierarchy (see Section 12.8, “Explicit Caching”). 


The CLFLUSH and CLFLUSHOPT instructions allow selected cache lines to be flushed from memory. These instruc- 
tions give a program the ability to explicitly free up cache space, when it is known that cached section of system 
memory will not be accessed in the near future. 


The non-temporal move instructions (MOVNTI, MOVNTQ, MOVNTDQ, MOVNTPS, and MOVNTPD) allow data to be 
moved from the processor’s registers directly into system memory without being also written into the L1, L2, 
and/or L3 caches. These instructions can be used to prevent cache pollution when operating on data that is going 
to be modified only once before being stored back into system memory. These instructions operate on data in the 
general-purpose, MMX, and XMM registers. 
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12.5.6 1 Data Cache Context Mode 


Li data cache context mode is a feature of processors based on the Intel NetBurst microarchitecture that support 
Intel Hyper-Threading Technology. When CPUID.1:ECX[bit 10] = 1, the processor supports setting L1 data cache 
context mode using the L1 data cache context mode flag ( IA32_MISC_ENABLE[bit 24] ). Selectable modes are 
adaptive mode (default) and shared mode. 


The BIOS is responsible for configuring the L1 data cache context mode. 


12.5.6.1 Adaptive Mode 


Adaptive mode facilitates L1 data cache sharing between logical processors. When running in adaptive mode, the 
L1 data cache is shared across logical processors in the same core if: 


® CR3 control registers for logical processors sharing the cache are identical. 
¢ The same paging mode is used by logical processors sharing the cache. 


In this situation, the entire L1 data cache is available to each logical processor (instead of being competitively 
shared). 


If CR3 values are different for the logical processors sharing an Li data cache or the logical processors use different 
paging modes, processors compete for cache resources. This reduces the effective size of the cache for each logical 
processor. Aliasing of the cache is not allowed (which prevents data thrashing). 


12.5.6.2 Shared Mode 


In shared mode, the L1 data cache is competitively shared between logical processors. This is true even if the 
logical processors use identical CR3 registers and paging modes. 


In shared mode, linear addresses in the L1 data cache can be aliased, meaning that one linear address in the cache 
can point to different physical locations. The mechanism for resolving aliasing can lead to thrashing. For this 
reason, IA32_MISC_ENABLE[bit 24] = 0 is the preferred configuration for processors based on the Intel NetBurst 
microarchitecture that support Intel Hyper-Threading Technology. 


12.6 SELF-MODIFYING CODE 


A write to a memory location in a code segment that is currently cached in the processor causes the associated 
cache line (or lines) to be invalidated. This check is based on the physical address of the instruction. In addition, 
the P6 family and Pentium processors check whether a write to a code segment may modify an instruction that has 
been prefetched for execution. If the write affects a prefetched instruction, the prefetch queue is invalidated. This 
latter check is based on the linear address of the instruction. For the Pentium 4 and Intel Xeon processors, a write 
or a snoop of an instruction in a code segment, where the target instruction is already decoded and resident in the 
trace cache, invalidates the entire trace cache. The latter behavior means that programs that self-modify code can 
cause severe degradation of performance when run on the Pentium 4 and Intel Xeon processors. 


In practice, the check on linear addresses should not create compatibility problems among IA-32 processors. Appli- 
cations that include self-modifying code use the same linear address for modifying and fetching the instruction. 
Systems software, such as a debugger, that might possibly modify an instruction using a different linear address 
than that used to fetch the instruction, will execute a serializing operation, such as a CPUID instruction, before the 
modified instruction is executed, which will automatically resynchronize the instruction cache and prefetch queue. 
(See Section 9.1.3, “Handling Self- and Cross-Modifying Code,” for more information about the use of self-modi- 
fying code.) 


For Intel486 processors, a write to an instruction in the cache will modify it in both the cache and memory, but if 
the instruction was prefetched before the write, the old version of the instruction could be the one executed. To 
prevent the old instruction from being executed, flush the instruction prefetch unit by coding a jump instruction 
immediately after any write that modifies an instruction. 
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12.7. IMPLICIT CACHING (PENTIUM 4, INTEL® XEON®, AND P6 FAMILY 
PROCESSORS) 


Implicit caching occurs when a memory element is made potentially cacheable, although the element may never 
have been accessed in the normal von Neumann sequence. Implicit caching occurs on the P6 and more recent 
processor families due to aggressive prefetching, branch prediction, and TLB miss handling. Implicit caching is an 
extension of the behavior of existing Intel386, Intel486, and Pentium processor systems, since software running 
on these processor families also has not been able to deterministically predict the behavior of instruction prefetch. 


To avoid problems related to implicit caching, the operating system must explicitly invalidate the cache when 
changes are made to cacheable data that the cache coherency mechanism does not automatically handle. This 
includes writes to dual-ported or physically aliased memory boards that are not detected by the snooping mecha- 
nisms of the processor, and changes to page- table entries in memory. 


The code in Example 12-1 shows the effect of implicit caching on page-table entries. The linear address FOOOH 
points to physical location BOOOH (the page-table entry for FOOOH contains the value BOOOH), and the page-table 
entry for linear address FOOO is PTE_FOOO. 


Example 12-1. Effect of Implicit Caching on Page-Table Entries 


mov EAX, CR3; Invalidate the TLB 

mov CR3, EAX; by copying CR3 to itself 

mov PTE_FOOO, AOOOH; Change FOOOH to point to AOOOH 
mov EBX, [FOOOH]; 


Because of speculative execution in the P6 and more recent processor families, the last MOV instruction performed 
would place the value at physical location BOOOH into EBX, rather than the value at the new physical address 
AOOOH. This situation is remedied by placing a TLB invalidation between the load and the store. 


12.8 EXPLICIT CACHING 


The Pentium III processor introduced four new instructions, the PREFETCHA instructions, that provide software with 
explicit control over the caching of data. These instructions provide “hints” to the processor that the data requested 
by a PREFETCHA instruction should be read into cache hierarchy now or as soon as possible, in anticipation of its 
use. The instructions provide different variations of the hint that allow selection of the cache level into which data 
will be read. 


The PREFETCHA instructions can help reduce the long latency typically associated with reading data from memory 
and thus help prevent processor “stalls.” However, these instructions should be used judiciously. Overuse can lead 
to resource conflicts and hence reduce the performance of an application. Also, these instructions should only be 
used to prefetch data from memory; they should not be used to prefetch instructions. For more detailed informa- 
tion on the proper use of the prefetch instruction, refer to Chapter 7, “Optimizing Cache Usage,” in the Intel® 64 
and IA-32 Architectures Optimization Reference Manual. 


12.9 INVALIDATING THE TRANSLATION LOOKASIDE BUFFERS (TLBS) 


The processor updates its address translation caches (TLBs) transparently to software. Several mechanisms are 
available, however, that allow software and hardware to invalidate the TLBs either explicitly or as a side effect of 
another operation. Most details are given in Section 4.10.4, “Invalidation of TLBs and Paging-Structure Caches.” In 
addition, the following operations invalidate all TLB entries, irrespective of the setting of the G flag: 


¢ Asserting or de-asserting the FLUSH# pin. 
¢ (Pentium 4, Intel Xeon, and later processors only.) Writing to an MTRR (with a WRMSR instruction). 
¢ Writing to control register CRO to modify the PG or PE flag. 
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e (Pentium 4, Intel Xeon, and later processors only.) Writing to control register CR4 to modify the PSE, PGE, or 
PAE flag. 


* Writing to control register CR4 to change the PCIDE flag from 1 to 0. 
See Section 4.10, “Caching Translation Information,” for additional information about the TLBs. 


12.10 STORE BUFFER 


Intel 64 and IA-32 processors temporarily store each write (store) to memory in a store buffer. The store buffer 
improves processor performance by allowing the processor to continue executing instructions without having to 
wait until a write to memory and/or to a cache is complete. It also allows writes to be delayed for more efficient use 
of memory-access bus cycles. 


In general, the existence of the store buffer is transparent to software, even in systems that use multiple proces- 
sors. The processor ensures that write operations are always carried out in program order. It also ensures that the 
contents of the store buffer are always drained to memory in the following situations: 


¢ When an exception or interrupt is generated. 

¢ (P6 and more recent processor families only) When a serializing instruction is executed. 

¢ When an J/O instruction is executed. 

¢ When a LOCK operation is performed. 

¢ (P6 and more recent processor families only) When a BINIT operation is performed. 

¢ (Pentium Ill, and more recent processor families only) When using an SFENCE instruction to order stores. 
¢ (Pentium 4 and more recent processor families only) When using an MFENCE instruction to order stores. 


The discussion of write ordering in Section 9.2, ‘Memory Ordering,” gives a detailed description of the operation of 
the store buffer. 


12.11 MEMORY TYPE RANGE REGISTERS (MTRRS) 


The following section pertains only to the P6 and more recent processor families. 


The memory type range registers (MTRRs) provide a mechanism for associating the memory types (see Section 
12.3, “Methods of Caching Available”) with physical-address ranges in system memory. They allow the processor to 
optimize operations for different types of memory such as RAM, ROM, frame-buffer memory, and memory-mapped 
I/O devices. They also simplify system hardware design by eliminating the memory control pins used for this func- 
tion on earlier IA-32 processors and the external logic needed to drive them. 


The MTRR mechanism allows multiple ranges to be defined in physical memory, and it defines a set of model- 
specific registers (MSRs) for specifying the type of memory that is contained in each range. Table 12-8 shows the 
memory types that can be specified and their properties; Figure 12-4 shows the mapping of physical memory with 
MTRRs. See Section 12.3, “Methods of Caching Available,” for a more detailed description of each memory type. 


Following a hardware reset, the P6 and more recent processor families disable all the fixed and variable MTRRs, 
which in effect makes all of physical memory uncacheable. Initialization software should then set the MTRRs to a 
specific, system-defined memory map. Typically, the BIOS (basic input/output system) software configures the 
MTRRs. The operating system or executive is then free to modify the memory map using the normal page-level 
cacheability attributes. 


In a multiprocessor system using a processor in the P6 family or a more recent family, each processor MUST use 
the identical MTRR memory map so that software will have a consistent view of memory. 


NOTE 


In multiple processor systems, the operating system must maintain MTRR consistency between all 
the processors in the system (that is, all processors must use the same MTRR values). The P6 and 
more recent processor families provide no hardware support for maintaining this consistency. 
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Table 12-8. Memory Types That Can Be Encoded in MTRRs 


Memory Type and Mnemonic Encoding in MTRR 

Uncacheable (UC) OOH 

Write Combining (WC) 01H 
Reserved* 02H 
Reserved* 03H 
Write-through (WT) 04H 
Write-protected (WP) O5H 
Writeback (WB) O6H 
Reserved* 7H through FFH 
NOTE: 


* 


Use of these encodings results in a general-protection exception (#GP). 


Physical Memory 


Address ranges not 


are set to a default type 


Variable ranges 
(from 4 KBytes to 
maximum size of 
physical memory) 


64 fixed ranges 
(4 KBytes each) > 
16 fixed ranges 

(16 KBytes each) 


8 fixed ranges 
(64-KBytes each) 7 


mapped by an MTRR —_»S 


256 KBytes 


256 KBytes 


512 KBytes 


FFFFFFFFH 


100000H 
FFFFFH 


CO000H 
BFFFFH 


80000H 
7FFFFH 


0 


Figure 12-4. Mapping Physical Memory With MTRRs 


12.11.1 MTRR Feature Identification 


The availability of the MTRR feature is model-specific. Software can determine if MTRRs are supported ona 
processor by executing the CPUID instruction and reading the state of the MTRR flag (bit 12) in the feature infor- 


mation register (EDX). 


If the MTRR flag is set (indicating that the processor implements MTRRs), additional information about MTRRs can 
be obtained from the 64-bit IA32_MTRRCAP MSR (named MTRRcap MSR for the P6 family processors). The 
IA32_MTRRCAP MSR is a read-only MSR that can be read with the RDMSR instruction. Figure 12-5 shows the 
contents of the IA32_MTRRCAP MSR. The functions of the flags and field in this register are as follows: 
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¢ VCNT (variable range registers count) field, bits O through 7 — Indicates the number of variable ranges 
implemented on the processor. 

° FIX (fixed range registers supported) flag, bit 8 — Fixed range MTRRs (IA32_MTRR_FIX64K_00000 
through IA32_MTRR_FIX4K_OF8000) are supported when set; no fixed range registers are supported when 
clear. 


¢ WC (write combining) flag, bit 10 — The write-combining (WC) memory type is supported when set; the 
WC type is not supported when clear. 


° SMRR (System-Management Range Register) flag, bit 11 — The system-management range register 
(SMRR) interface is supported when bit 11 is set; the SMRR interface is not supported when clear. 


Bit 9 and bits 12 through 63 in the IA32_MTRRCAP MSR are reserved. If software attempts to write to the 
IA32_MTRRCAP MSR, a general-protection exception (#GP) is generated. 


Software must read IA32_MTRRCAP VCNT field to determine the number of variable MTRRs and query other 
feature bits in IA32_MTRRCAP to determine additional capabilities that are supported in a processor. For example, 
some processors may report a value of ‘8’ in the VCNT field, other processors may report VCNT with different 
values. 


63 11109 87 0 


Ww 
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F 
Reserved | a VCNT 


SMRR — SMRR interface supported | 


WC — Write-combining memory type supported —~ 
FIX — Fixed range registers supported 
VCNT — Number of variable range registers 


Reserved 


Figure 12-5. IA32_MTRRCAP Register 


12.11.2 Setting Memory Ranges with MTRRs 


The memory ranges and the types of memory specified in each range are set by three groups of registers: the 
IA32_MTRR_DEF_TYPE MSR, the fixed-range MTRRs, and the variable range MTRRs. These registers can be read 
and written to using the RDMSR and WRMSR instructions, respectively. The IA32_MTRRCAP MSR indicates the 
availability of these registers on the processor (see Section 12.11.1, “MTRR Feature Identification”). 


12.11.2.1 IA32_MTRR_DEF_TYPE MSR 


The IA32_MTRR_DEF_TYPE MSR (named MTRRdefType MSR for the P6 family processors) sets the default proper- 
ties of the regions of physical memory that are not encompassed by MTRRs. The functions of the flags and field in 
this register are as follows: 


° Type field, bits O through 7 — Indicates the default memory type used for those physical memory address 
ranges that do not have a memory type specified for them by an MTRR (see Table 12-8 for the encoding of this 
field). The legal values for this field are 0, 1, 4, 5, and 6. All other values result in a general-protection 
exception (#GP) being generated. 


Intel recommends the use of the UC (uncached) memory type for all physical memory addresses where 
memory does not exist. To assign the UC type to nonexistent memory locations, it can either be specified as the 
default type in the Type field or be explicitly assigned with the fixed and variable MTRRs. 
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Reserved E Type 


E — MTRR enable/disable 
FE — Fixed-range MTRRs enable/disable —— 
Type — Default memory type 


Reserved 


Figure 12-6. I|A32_MTRR_DEF_TYPE MSR 


¢ FE (fixed MTRRs enabled) flag, bit 10 — Fixed-range MTRRs are enabled when set; fixed-range MTRRs are 
disabled when clear. When the fixed-range MTRRs are enabled, they take priority over the variable-range 
MTRRs when overlaps in ranges occur. If the fixed-range MTRRs are disabled, the variable-range MTRRs can 
still be used and can map the range ordinarily covered by the fixed-range MTRRs. 

¢ E(MTRRs enabled) flag, bit 11 — MTRRs are enabled when set; all MTRRs are disabled when clear, and the 
UC memory type is applied to all of physical memory. When this flag is set, the FE flag can disable the fixed- 
range MTRRs; when the flag is clear, the FE flag has no affect. When the E flag is set, the type specified in the 
default memory type field is used for areas of memory not already mapped by either a fixed or variable MTRR. 


Bits 8 and 9, and bits 12 through 63, in the IA32_MTRR_DEF_TYPE MSR are reserved; the processor generates a 
general-protection exception (#GP) if software attempts to write nonzero values to them. 


12.11.2.2 Fixed Range MTRRs 

The fixed memory ranges are mapped with 11 fixed-range registers of 64 bits each. Each of these registers is 

divided into 8-bit fields that are used to specify the memory type for each of the sub-ranges the register controls: 

° Register IA32_MTRR_FIX64K_00000 — Maps the 512-KByte address range from OH to 7FFFFH. This range 
is divided into eight 64-KByte sub-ranges. 


° Registers IA32_MTRR_FIX16K_80000 and IA32_MTRR_FIX16K_AO0000 — Maps the two 128-KByte 
address ranges from 80000H to BFFFFH. This range is divided into sixteen 16-KByte sub-ranges, 8 ranges per 
register. 


° Registers IA32_MTRR_FIX4K_C0000 through IA32_MTRR_FIX4K_F8000 — Maps eight 32-KByte 
address ranges from COOOOH to FFFFFH. This range is divided into sixty-four 4-KByte sub-ranges, 8 ranges per 
register. 


Table 12-9 shows the relationship between the fixed physical-address ranges and the corresponding fields of the 
fixed-range MTRRs; Table 12-8 shows memory type encoding for MTRRs. 


For the P6 family processors, the prefix for the fixed range MTRRs is MTRRfix. 


12.11.2.3 Variable Range MTRRs 


The Pentium 4, Intel Xeon, and P6 family processors permit software to specify the memory type for m variable- 
size address ranges, using a pair of MTRRs for each range. The number m of ranges supported is given in bits 7:0 
of the IA32_MTRRCAP MSR (see Figure 12-5 in Section 12.11.1). 


The first entry in each pair (IA32_MTRR_PHYSBASEn) defines the base address and memory type for the range; 
the second entry (IA32_MTRR_PHYSMASKn) contains a mask used to determine the address range. The “n” suffix 
is in the range 0 through m-1 and identifies a specific register pair. 


For P6 family processors, the prefixes for these variable range MTRRs are MTRRphysBase and MTRRphysMask. 
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Table 12-9. Address Mapping for Fixed-Range MTRRs 


Address Range (hexadecimal) MTRR 

63 56 55 48 47 40 39 32 31 24 23 «+16 15 8 7 0 

70000- 60000- 50000- 40000- 30000- 20000- 10000- 00000- IA32_MTRR_ 
7FFFF 6FFFF 5SFFFF 4FFFF 3FFFF 2FFFF 1FFFF OFFFF FIX64K_00000 
9CO00 98000- 94000- 90000- 8C000- 88000- 84000- 80000- IA32_MTRR_ 
OFFFF OBFFF 97FFF 93FFF 8FFFF 8BFFF 87FFF 83FFF FIX16K_80000 
BCOOO B8000- B4000- BOOOO- ACOO0- A8000- A4000- AOQO00- IA32_MTRR_ 
BFFFF BBFFF B7FFF B3FFF AFFFF ABFFF A7FFF A3FFF FIX16K_A0000 
C7000 C6000- C5000- C4000- C3000- C2000- C1000- Co000- IA32_MTRR_ 
C7FFF C6FFF CSFFF C4FFF C3FFF C2FFF C1FFF COFFF FIX4K_COO00 
CFOOO CEOO0- CDO00- CCOO0- CBOO0- CAO00- C9000- C8000- IA32_MTRR_ 
CFFFF CEFFF CDFFF CCFFF CBFFF CAFFF COFFF C8FFF FIX4K_C8000 
D7000 D6000- D5000- D4000- D3000- D2000- D1000- DOOOD- IA32_MTRR_ 
D7FFF D6FFF D5FFF D4FFF D3FFF D2FFF D1FFF DOFFF FIX4K_DO000 
DFOOO DEOOO- DDOOO- DCOOO- DBOOO- DAOOO- D9000- D8000- IA32_MTRR_ 
DFFFF DEFFF DDFFF DCFFF DBFFF DAFFF DOFFF D8FFF FIX4K_D8000 
€7000 €6000- €5000- €4000- €3000- €2000- €1000- €0000- IA32_MTRR_ 
E7FFF E6FFF ESFFF E4FFF E3FFF E2FFF E1FFF EOFFF FIX4K_E0000 
EFOOO EEOOO- EDOOO- ECOOO- EBOOO- EAOOO- €9000- €8000- IA32_MTRR_ 
EFFFF EEFFF EDFFF ECFFF EBFFF EAFFF ESFFF E8FFF FIX4K_E8000 
F7000 F6000- F5000- F4000- F3000- F2000- F1000- FOOOO- IA32_MTRR_ 
F7FFF F6FFF FSFFF F4FFF F3FFF F2FFF FIFFF FOFFF FIX4K_FOO00 
FFOOO FEOOO- FDOOO- FCOOO- FBOOO- FAOOO- F9000- F8000- IA32_MTRR_ 
FFFFF FEFFF FDFFF FCFFF FBFFF FAFFF FOFFF F8FFF FIX4K_F8000 


Figure 12-7 shows flags and fields in these registers. The functions of these flags and fields are: 


° Type field, bits 0 through 7 — Specifies the memory type for the range (see Table 12-8 for the encoding of 


this field). 


° PhysBase field, bits 12 through (MAXPHYADDR-1) — Specifies the base address of the address range. 
This 24-bit value, in the case where MAXPHYADDR is 36 bits, is extended by 12 bits at the low end to form the 
base address (this automatically aligns the address on a 4-KByte boundary). 

¢ PhysMask field, bits 12 through (MAXPHYADDR-1) — Specifies a mask (24 bits if the maximum physical 
address size is 36 bits, 28 bits if the maximum physical address size is 40 bits). The mask determines the range 


of the region being mapped, according to the following relationships: 
— Address_Within_Range AND PhysMask = PhysBase AND PhysMask 


— This value is extended by 12 bits at the low end to form the mask value. For more information: see Section 
12.11.3, “Example Base and Mask Calculations.” 


— The width of the PhysMask field depends on the maximum physical address size supported by the 
processor. 


CPUID.80000008H reports the maximum physical address size supported by the processor. If 


CPUID.80000008H is not available, software may assume that the processor supports a 36-bit physical 


address size (then PhysMask is 24 bits wide and the upper 28 bits of IA832_MTRR_PHYSMASkKn are 
reserved). See the Note below. 


* V (valid) flag, bit 11 — Enables the register pair when set; disables register pair when clear. 
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IA32_MTRR_PHYSBASEn Register 
63 MAXPHYADDR_ 1211 87 0 


Reserved PhysBase Type 


PhysBase — Base address of range —! 
Type — Memory type for range 


IA32_MTRR_PHYSMASKn Register 
63 MAXPHYADDR 121110 0 


Reserved PhysMask Vv Reserved 


PhysMask — Sets range mask — 
V — Valid 


Reserved 


MAXPHYADDR: The bit position indicated by MAXPHYADDR depends on the maximum 
physical address range supported by the processor. It is reported by CPUID leaf 
function 80000008H. If CPUID does not support leaf 80000008H, the processor 
supports 36-bit physical address size, then bit PhysMask consists of bits 35:12, and 

bits 63:36 are reserved. 


Figure 12-7. |A32_MTRR_PHYSBASEn and IA32_MTRR_PHYSMASKn Variable-Range Register Pair 


All other bits in the IA32_MTRR_PHYSBASEn and IA32_MTRR_PHYSMASkKnr registers are reserved; the processor 
generates a general-protection exception (#GP) if software attempts to write to them. 


Some mask values can result in ranges that are not continuous. In such ranges, the area not mapped by the mask 
value is set to the default memory type, unless some other MTRR specifies a type for that range. Intel does not 
encourage the use of “discontinuous” ranges. 


NOTE 


It is possible for software to parse the memory descriptions that BIOS provides by using the 
ACPI/INT15 e820 interface mechanism. This information then can be used to determine how 
MTRRs are initialized (for example: allowing the BIOS to define valid memory ranges and the 
maximum memory range supported by the platform, including the processor). 


See Section 12.11.4.1, “MTRR Precedences,” for information on overlapping variable MTRR ranges. 


12.11.2.4 System-Management Range Register Interface 


If IA32_MTRRCAP[bit 11] is set, the processor supports the SMRR interface to restrict access to a specified 
memory address range used by system-management mode (SMM) software (see Section 32.4.2.1). If the SMRR 


interface is supported, SMM software is strongly encouraged to use it to protect the SMI code and data stored by 
SMI handler in the SMRAM region. 


The system-management range registers consist of a pair of MSRs (see Figure 12-8). The IA32_SMRR_PHYSBASE 
MSR defines the base address for the SMRAM memory range and the memory type used to access it in SMM. The 
IA32_SMRR_PHYSMASK MSR contains a valid bit and a mask that determines the SMRAM address range protected 
by the SMRR interface. These MSRs may be written only in SMM; an attempt to write them outside of SMM causes 
a general-protection exception. 


Figure 12-8 shows flags and fields in these registers. The functions of these flags and fields are the following: 


1. For some processor models, these MSRs can be accessed by RDMSR and WRMSR only if the SMRR interface has been enabled using 
a model-specific bit in the IA32_FEATURE_CONTROL MSR. 
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° Type field, bits O through 7 — Specifies the memory type for the range (see Table 12-8 for the encoding of 
this field). 


¢ PhysBase field, bits 12 through 31 — Specifies the base address of the address range. The address must be 
less than 4 GBytes and is automatically aligned on a 4-KByte boundary. 


¢ PhysMask field, bits 12 through 31 — Specifies a mask that determines the range of the region being 
mapped, according to the following relationships: 


— Address_Within_Range AND PhysMask = PhysBase AND PhysMask 


— This value is extended by 12 bits at the low end to form the mask value. For more information: see Section 
12.11.3, “Example Base and Mask Calculations.” 


¢ V (valid) flag, bit 11 — Enables the register pair when set; disables register pair when clear. 


Before attempting to access these SMRR registers, software must test bit 11 in the IA32_MTRRCAP register. If 
SMRR is not supported, reads from or writes to registers cause general-protection exceptions. 


When the valid flag in the IA32_SMRR_PHYSMASK MSR is 1, accesses to the specified address range are treated as 
follows: 


e If the logical processor is in SMM, accesses uses the memory type in the IA32_SMRR_PHYSBASE MSR. 


° If the logical processor is not in SMM, write accesses are ignored and read accesses return a fixed value for each 
byte. The uncacheable memory type (UC) is used in this case. 


The above items apply even if the address range specified overlaps with a range specified by the MTRRs. 


IA32_SMRR_PHYSBASE Register 
63 31 1211 87 0 


Reserved PhysBase Type 


PhysBase — Base address of range — 
Type — Memory type for range 


IA32_SMRR_PHYSMASK Register 
63 31 121110 0 


Reserved PhysMask v Reserved 


PhysMask — Sets range mask — 
V — Valid 


Reserved 


Figure 12-8. [A32_SMRR_PHYSBASE and IA32_SMRR_PHYSMASK SMRR Pair 


12.11.3 Example Base and Mask Calculations 


The examples in this section apply to processors that support a maximum physical address size of 36 bits. The base 
and mask values entered in variable-range MTRR pairs are 24-bit values that the processor extends to 36-bits. 


For example, to enter a base address of 2 MBytes (200000H) in the IA32_MTRR_PHYSBASES3 register, the 12 least- 
significant bits are truncated and the value 000200H is entered in the PhysBase field. The same operation must be 
performed on mask values. For example, to map the address range from 200000H to 3FFFFFH (2 MBytes to 4 
MBytes), a mask value of FFFEQOOOOH is required. Again, the 12 least-significant bits of this mask value are trun- 
cated, so that the value entered in the PhysMask field of IA32_MTRR_PHYSMASK3 is FFFEQOH. This mask is chosen 
so that when any address in the 200000H to 3FFFFFH range is AND’d with the mask value, it will return the same 
value as when the base address is AND’d with the mask value (which is 200000H). 
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To map the address range from 400000H to 7FFFFFH (4 MBytes to 8 MBytes), a base value of 000400H is entered 
in the PhysBase field and a mask value of FFFCOOH is entered in the PhysMask field. 


Example 12-2. Setting-Up Memory for a System 

Here is an example of setting up the MTRRs for an system. Assume that the system has the following characteris- 
tics: 

° 96 MBytes of system memory is mapped as write-back memory (WB) for highest system performance. 

¢ Acustom 4-MByte I/O card is mapped to uncached memory (UC) at a base address of 64 MBytes. This 


restriction forces the 96 MBytes of system memory to be addressed from 0 to 64 MBytes and from 68 MBytes 
to 100 MBytes, leaving a 4-MByte hole for the I/O card. 


¢ An 8-MByte graphics card is mapped to write-combining memory (WC) beginning at address AOOQOOOOH. 
¢ The BIOS area from 15 MBytes to 16 MBytes is mapped to UC memory. 


The following settings for the MTRRs will yield the proper mapping of the physical address space for this system 
configuration. 


IA32_MTRR_PHYSBASEO = 0000 0000 0000 OO06H 
IA32_MTRR_PHYSMASKO = 0000 OOOF FCOO O800H 
Caches 0-64 MByte as WB cache type. 


IA32_MTRR_PHYSBASE1 = 0000 0000 0400 OOO6GH 
IA32_MTRR_PHYSMASK1 = 0000 OOOF FEOO O800H 
Caches 64-96 MByte as WB cache type. 


IA32_MTRR_PHYSBASE2 = 0000 0000 0600 OOO6H 
IA32_MTRR_PHYSMASK2 = 0000 OOOF FFCO O800H 
Caches 96-100 MByte as WB cache type. 


IA32_MTRR_PHYSBASE3 = 0000 0000 0400 OO00H 
IA32_MTRR_PHYSMASK3 = 0000 OOOF FFCO O800H 
Caches 64-68 MByte as UC cache type. 


IA32_MTRR_PHYSBASE4 = 0000 0000 OOFO OO00H 
IA32_MTRR_PHYSMASK4 = 0000 OOOF FFFO O800H 
Caches 15-16 MByte as UC cache type. 


IA32_MTRR_PHYSBASE5 = 0000 0000 A000 0001H 
IA32_MTRR_PHYSMASK5 = 0000 OOOF FF80 O800H 
Caches AOOOO000-A0800000 as WC type. 


This MTRR setup uses the ability to overlap any two memory ranges (as long as the ranges are mapped to WB and 
UC memory types) to minimize the number of MTRR registers that are required to configure the memory environ- 
ment. This setup also fulfills the requirement that two register pairs are left for operating system usage. 


12.11.3.1 Base and Mask Calculations for Greater-Than 36-bit Physical Address Support 


For Intel 64 and IA-32 processors that support greater than 36 bits of physical address size, software should query 
CPUID.80000008H to determine the maximum physical address. See the example. 


Example 12-3. Setting-Up Memory for a System with a 40-Bit Address Size 
If a processor supports 40-bits of physical address size, then the PhysMask field (in IA32_MTRR_PHYSMASKn 
registers) is 28 bits instead of 24 bits. For this situation, Example 12-2 should be modified as follows: 


IA32_MTRR_PHYSBASEO = 0000 0000 0000 OO06H 
IA32_MTRR_PHYSMASKO = 0000 OOFF FCOO 0800H 
Caches 0-64 MByte as WB cache type. 
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IA32_MTRR_PHYSBASE1 = 0000 0000 0400 OO06H 
IA32_MTRR_PHYSMASK1 = 0000 OOFF FE00 O800H 
Caches 64-96 MByte as WB cache type. 


IA32_MTRR_PHYSBASE2 = 0000 0000 0600 OO0O6H 
IA32_MTRR_PHYSMASK2 = 0000 OOFF FFCO O800H 
Caches 96-100 MByte as WB cache type. 


IA32_MTRR_PHYSBASE3 = 0000 0000 0400 OO00H 
IA32_MTRR_PHYSMASK3 = 0000 OOFF FFCO O800H 
Caches 64-68 MByte as UC cache type. 


IA32_MTRR_PHYSBASE4 = 0000 0000 OOFO OOOOH 
IA32_MTRR_PHYSMASK4 = 0000 OOFF FFFO O800H 
Caches 15-16 MByte as UC cache type. 


IA32_MTRR_PHYSBASE5 = 0000 0000 A000 0001H 
IA32_MTRR_PHYSMASK5 = 0000 OOFF FF80 0800H 
Caches AOOOO000-A0800000 as WC type. 


12.11.4 Range Size and Alignment Requirement 


A range that is to be mapped to a variable-range MTRR must meet the following “power of 2” size and alignment 
rules: 


1. The minimum range size is 4 KBytes and the base address of the range must be on at least a 4-KByte 
boundary. 


2. For ranges greater than 4 KBytes, each range must be of length 2” and its base address must be aligned on a 
2” boundary, where rn is a value equal to or greater than 12. The base-address alignment value cannot be less 
than its length. For example, an 8-KByte range cannot be aligned on a 4-KByte boundary. It must be aligned on 
at least an 8-KByte boundary. 


12.11.4.1 MTRR Precedences 


If the MTRRs are not enabled (by setting the E flag in the IA32_MTRR_DEF_TYPE MSR), then all memory accesses 
are of the UC memory type. If the MTRRs are enabled, then the memory type used for a memory access is deter- 
mined as follows: 


1. If the physical address falls within the first 1 MByte of physical memory and fixed MTRRs are enabled, the 
processor uses the memory type stored for the appropriate fixed-range MTRR. 


2. Otherwise, the processor attempts to match the physical address with a memory type set by the variable-range 
MTRRs: 


— If one variable memory range matches, the processor uses the memory type stored in the 
IA32_MTRR_PHYSBASEn register for that range. 


— Iftwoor more variable memory ranges match and the memory types are identical, then that memory type 
is used. 


— If two or more variable memory ranges match and one of the memory types is UC, the UC memory type 
used. 


— Iftwoor more variable memory ranges match and the memory types are WT and WB, the WT memory type 
is used. 


— For overlaps not defined by the above rules, processor behavior is undefined. 
3. If no fixed or variable memory range matches, the processor uses the default memory type. 
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12.11.5 MTRR Initialization 


On a hardware reset, the P6 and more recent processors clear the valid flags in variable-range MTRRs and clear the 
E flag in the IA32_MTRR_DEF_TYPE MSR to disable all MTRRs. All other bits in the MTRRs are undefined. 


Prior to initializing the MTRRs, software (normally the system BIOS) must initialize all fixed-range and variable- 
range MTRR register fields to 0. Software can then initialize the MTRRs according to known types of memory, 
including memory on devices that it auto-configures. Initialization is expected to occur prior to booting the oper- 
ating system. 


See Section 12.11.8, “MTRR Considerations in MP Systems,” for information on initializing MTRRs in MP (multiple- 
processor) systems. 


12.11.6 Remapping Memory Types 


A system designer may re-map memory types to tune performance or because a future processor may not imple- 
ment all memory types supported by the Pentium 4, Intel Xeon, and P6 family processors. The following rules 
support coherent memory-type re-mappings: 


1. A memory type should not be mapped into another memory type that has a weaker memory ordering model. 
For example, the uncacheable type cannot be mapped into any other type, and the write-back, write-through, 
and write-protected types cannot be mapped into the weakly ordered write-combining type. 


2. Amemory type that does not delay writes should not be mapped into a memory type that does delay writes, 
because applications of such a memory type may rely on its write-through behavior. Accordingly, the write- 
back type cannot be mapped into the write-through type. 


3. Amemory type that views write data as not necessarily stored and read back by a subsequent read, such as 
the write-protected type, can only be mapped to another type with the same behavior (and there are no others 
for the Pentium 4, Intel Xeon, and P6 family processors) or to the uncacheable type. 


In many specific cases, a system designer can have additional information about how a memory type is used, 
allowing additional mappings. For example, write-through memory with no associated write side effects can be 
mapped into write-back memory. 


12.11.7_ MTRR Maintenance Programming Interface 


The operating system maintains the MTRRs after booting and sets up or changes the memory types for memory- 
mapped devices. The operating system should provide a driver and application programming interface (API) to 
access and set the MTRRs. The function calls MemTypeGet() and MemTypeSet() define this interface. 


12.11.7.1 MemTypeGet() Function 


The MemTypeGet() function returns the memory type of the physical memory range specified by the parameters 
base and size. The base address is the starting physical address and the size is the number of bytes for the memory 
range. The function automatically aligns the base address and size to 4-KByte boundaries. Pseudocode for the 
MemTypeGet() function is given in Example 12-4. 
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Example 12-4. MemTypeGet() Pseudocode 
#define MIXED_TYPES -1_ /* 0 < MIXED_TYPES || MIXED_TYPES > 256 */ 


IF CPU_FEATURES.MTRR /* processor supports MTRRs */ 
THEN 

Align BASE and SIZE to 4-KByte boundary; 

IF (BASE + SIZE) wrap physical-address space 
THEN return INVALID; 

Fl; 

IF MTRRdefType.€ = 0 
THEN return UC; 

Fl; 

FirstType := Get4KMemType (BASE); 

/* Obtains memory type for first 4-KByte range. */ 

/* See Get4KMemType (4KByteRange) in Example 12-5. */ 

FOR each additional 4-KByte range specified in SIZE 
NextType := Get4KMemType (4KByteRange); 
IF NextType != FirstType 

THEN return Mixed_Types; 

Fl; 

ROF; 

return FirstType; 

ELSE return UNSUPPORTED; 
Fl; 


If the processor does not support MTRRs, the function returns UNSUPPORTED. If the MTRRs are not enabled, then 
the UC memory type is returned. If more than one memory type corresponds to the specified range, a status of 
MIXED_TYPES is returned. Otherwise, the memory type defined for the range (UC, WC, WT, WB, or WP) is 
returned. 


The pseudocode for the Get4KMemType() function in Example 12-5 obtains the memory type for a single 4-KByte 
range at a given physical address. The sample code determines whether an PHY_ADDRESS falls within a fixed 
range by comparing the address with the known fixed ranges: 0 to 7FFFFH (64-KByte regions), 80000H to BFFFFH 
(16-KByte regions), and COOOOH to FFFFFH (4-KByte regions). If an address falls within one of these ranges, the 
appropriate bits within one of its MTRRs determine the memory type. 


Example 12-5. Get4KMemType() Pseudocode 


IF IA32 MTRRCAP.FIX AND MTRRdefType.FE /* fixed registers enabled */ 
THEN IF PHY ADDRESS is within a fixed range 
return [A32_MTRR_FIX.Type; 


Fl; 
FOR each variable-range MTRR in IA32_MTRRCAP.VCNT 
IF 1A32_MTRR_PHYSMASK.V = 0 
THEN continue; 
Fl; 
IF (PHY_ADDRESS AND IA32_MTRR_PHYSMASK.Mask) = 
(IA32_MTRR_PHYSBASE.Base 
AND IA32_MTRR_PHYSMASK.Mask) 
THEN 
return [IA32_MTRR_PHYSBASE.Type; 
Fl; 
ROF; 
return MTRRdefType.Type; 
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12.11.7.2  MemTypeSet() Function 


The MemTypeSet() function in Example 12-6 sets a MTRR for the physical memory range specified by the parame- 


ters base and size to the type specified by type. The base address and size are multiples of 4 KBytes and the size 
is not 0. 


Example 12-6. MemTypeSet Pseudocode 


IF CPU_FEATURES.MTRR (* processor supports MTRRs *) 
THEN 
IF BASE and SIZE are not 4-KByte aligned or size is 0 

THEN return INVALID; 


IF (BASE + SIZE) wrap 4-GByte address space 
THEN return INVALID; 


FI; 

IF TYPE is invalid for Pentium 4, Intel Xeon, and P6 family 
processors 

THEN return UNSUPPORTED; 


FI; 
IF TYPE is WC and not supported 
THEN return UNSUPPORTED; 


FI; 
IF IA32 MTRRCAP.FIX is set AND range can be mapped using a 
fixed-range MTRR 
THEN 
pre _mtrr_change(); 
update affected MTRR; 
post_mtrr_change(); 


ELSE (* try to map using a variable MTRR pair *) 
IF IA32 MTRRCAP.VCNT = 0 
THEN return UNSUPPORTED; 


IF conflicts with current variable ranges 
THEN return RANGE OVERLAP; 


IF no MTRRs available 
N return VAR_NOT AVAILABLE 


I 
I 


~e 


FI; 
IF BASE and SIZE do not meet the power of 2 requirements for 
variable MTRRs 

THEN return INVALID VAR REQUEST; 


al 


FI; 

pre _mtrr_change(); 

Update affected MTRRs; 

post_mtrr_ change(); 
FI; 


pre_mtrr_change() 
BEGIN 
disable interrupts; 


Save current value of CR4; 
disable and flush caches; 
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flush TLBs; 
disable MTRRs; 
IF multiprocessing 


THEN maintain consistency through IPIs; 
FI; 
END 
post_mtrr_ change () 
BEGIN 
flush caches and TLBs; 
enable MTRRs; 
enable caches; 


restore value of CR4; 
enable interrupts; 
END 


The physical address to variable range mapping algorithm in the MemTypeSet function detects conflicts with 
current variable range registers by cycling through them and determining whether the physical address in question 
matches any of the current ranges. During this scan, the algorithm can detect whether any current variable ranges 
overlap and can be concatenated into a single range. 


The pre_mtrr_change() function disables interrupts prior to changing the MTRRs, to avoid executing code with a 
partially valid MTRR setup. The algorithm disables caching by setting the CD flag and clearing the NW flag in control 
register CRO. The caches are invalidated using the WBINVD instruction. The algorithm flushes all TLB entries either 
by clearing the page-global enable (PGE) flag in control register CR4 (if PGE was already set) or by updating control 
register CR3 (if PGE was already clear). Finally, it disables MTRRs by clearing the E flag in the 
IA32_MTRR_DEF_TYPE MSR. 


After the memory type is updated, the post_mtrr_change() function re-enables the MTRRs and again invalidates 
the caches and TLBs. This second invalidation is required because of the processor's aggressive prefetch of both 
instructions and data. The algorithm restores interrupts and re-enables caching by setting the CD flag. 


An operating system can batch multiple MTRR updates so that only a single pair of cache invalidations occur. 


12.11.8 MTRR Considerations in MP Systems 


In MP (multiple-processor) systems, the operating systems must maintain MTRR consistency between all the 
processors in the system. The Pentium 4, Intel Xeon, and P6 family processors provide no hardware support to 
maintain this consistency. In general, all processors must have the same MTRR values. 


This requirement implies that when the operating system initializes an MP system, it must load the MTRRs of the 
boot processor while the E flag in register MTRRdefType is 0. The operating system then directs other processors to 
load their MTRRs with the same memory map. After all the processors have loaded their MTRRs, the operating 
system signals them to enable their MTRRs. Barrier synchronization is used to prevent further memory accesses 
until all processors indicate that the MTRRs are enabled. This synchronization is likely to be a shoot-down style 
algorithm, with shared variables and interprocessor interrupts. 


Any change to the value of the MTRRs in an MP system requires the operating system to repeat the loading and 
enabling process to maintain consistency, using the following procedure: 


Broadcast to all processors to execute the following code sequence. 

Disable interrupts. 

Wait for all processors to reach this point. 

Enter the no-fill cache mode. (Set the CD flag in control register CRO to 1 and the NW flag to 0.) 


Flush all caches using the WBINVD instructions. On a processor that supports self-snooping (enumerating 
CPUID.01H:EDX.SS[bit 27] as 1), this step may be unnecessary. However, if there are changes for which self- 
snooping behavior would be problematic (e.g., changing the memory type of a cache line from WB to UC for 
memory-mapped I/O), execution of WBINVD would still be required. 


G1 ae GN 
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If either the PGE or PCIDE flag is set in control register CR4, flush all TLBs by clearing one or both of these flags. 


If the PGE and PCIDE flags are both clear in control register CR4, flush all TLBs by executing a MOV from control 
register CR3 to another register and then a MOV from that register back to CR3. 


8. Disable all range registers (by clearing the E flag in register MTRRdefType). If only variable ranges are being 
modified, software may clear the valid bits for the affected register pairs instead. 


9. Update the MTRRs. 


10. Enable all range registers (by setting the E flag in register MTRRdefType). If only variable-range registers were 
modified and their individual valid bits were cleared, then set the valid bits for the affected ranges instead. 


11. Flush all caches and all TLBs a second time. (The TLB flush is required for Pentium 4, Intel Xeon, and P6 family 
processors. Executing the WBINVD instruction is not needed when using Pentium 4, Intel Xeon, and P6 family 
processors, but it may be needed in future systems. ) 


12. Enter the normal cache mode to re-enable caching. (Set the CD and NW flags in control register CRO to 0.) 
13. Restore the values of the PGE and/or PCIDE flags in control register CR4, if cleared in Step 6 (above). 

14. Wait for all processors to reach this point. 

15. Enable interrupts. 


12.11.9 Large Page Size Considerations 


The MTRRs provide memory typing for a limited number of regions that have a 4 KByte granularity (the same gran- 
ularity as 4-KByte pages). The memory type for a given page is cached in the processor’s TLBs. When using large 
pages (2 MBytes, 4 MBytes, or 1 GBytes), a single page-table entry covers multiple 4-KByte granules, each with a 
single memory type. Because the memory type for a large page is cached in the TLB, the processor can behave in 
an undefined manner if a large page is mapped to a region of memory that MTRRs have mapped with multiple 
memory types. 


Undefined behavior can be avoided by ensuring that all MTRR memory-type ranges within a large page are of the 
same type. If a large page maps to a region of memory containing different MTRR-defined memory types, the PCD 
and PWT flags in the page-table entry should be set for the most conservative memory type for that range. For 
example, a large page used for memory mapped I/O and regular memory is mapped as UC memory. Alternatively, 
the operating system can map the region using multiple 4-KByte pages each with its own memory type. 


The requirement that all 4-KByte ranges in a large page are of the same memory type implies that large pages with 
different memory types may suffer a performance penalty, since they must be marked with the lowest common 
denominator memory type. The same consideration apply to 1 GByte pages, each of which may consist of multiple 
2-Mbyte ranges. 


The Pentium 4, Intel Xeon, and P6 family processors provide special support for the physical memory range from 0 
to 4 MBytes, which is potentially mapped by both the fixed and variable MTRRs. This support is invoked when a 
Pentium 4, Intel Xeon, or P6 family processor detects a large page overlapping the first 1 MByte of this memory 
range with a memory type that conflicts with the fixed MTRRs. Here, the processor maps the memory range as 
multiple 4-KByte pages within the TLB. This operation ensures correct behavior at the cost of performance. To 
avoid this performance penalty, operating-system software should reserve the large page option for regions of 
memory at addresses greater than or equal to 4 MBytes. 


12.12 PAGE ATTRIBUTE TABLE (PAT) 


The Page Attribute Table (PAT) extends the IA-32 architecture’s page-table format to allow memory types to be 
assigned to regions of physical memory based on linear address mappings. The PAT is a companion feature to the 
MTRRs; that is, the MTRRs allow mapping of memory types to regions of the physical address space, where the PAT 
allows mapping of memory types to pages within the linear address space. The MTRRs are useful for statically 
describing memory types for physical ranges, and are typically set up by the system BIOS. The PAT extends the 
functions of the PCD and PWT bits in page tables to allow all five of the memory types that can be assigned with the 
MTRRs (plus one additional memory type) to also be assigned dynamically to pages of the linear address space. 
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The PAT was introduced to IA-32 architecture on the Pentium III processor. It is also available in the Pentium 4 and 
Intel Xeon processors. 


12.12.1 Detecting Support for the PAT Feature 


An operating system or executive can detect the availability of the PAT by executing the CPUID instruction with a 
value of 1 in the EAX register. Support for the PAT is indicated by the PAT flag (bit 16 of the values returned to EDX 
register). If the PAT is supported, the operating system or executive can use the IA32_PAT MSR to program the PAT. 
When memory types have been assigned to entries in the PAT, software can then use of the PAT-index bit (PAT) in 
the page-table and page-directory entries along with the PCD and PWT bits to assign memory types from the PAT 
to individual pages. 


Note that there is no separate flag or control bit in any of the control registers that enables the PAT. The PAT is 
always enabled on all processors that support it, and the table lookup always occurs whenever paging is enabled, 
in all paging modes. 


12.12.2 IA32_PAT MSR 


The IA32_PAT MSR is located at MSR address 277H (see Chapter 2, “Model-Specific Registers (MSRs),” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4). Figure 12-9. shows the format of the 
64-bit IA32_PAT MSR. 


The IA32_PAT MSR contains eight page attribute fields: PAO through PA7. The three low-order bits of each field are 
used to specify a memory type. The five high-order bits of each field are reserved, and must be set to all Os. Each 
of the eight page attribute fields can contain any of the memory type encodings specified in Table 12-10. 


31 27 26 24 23 19 18 16 15 11 10 8 7 3 2 0 
Reserved PA3 Reserved PA2 Reserved PA1 Reserved 


63 59 58 56 55 51 50 48 47 43 42 40 39 35 34 32 
Reserved PA7 Reserved PA6 Reserved PAS Reserved 


Figure 12-9. [A32_PAT MSR 
Note that for the P6 family processors, the IA32_PAT MSR is named the PAT MSR. 


Table 12-10. Memory Types That Can Be Encoded With PAT 


Encoding Mnemonic 
OOH Uncacheable (UC) 
01H Write Combining (WC) 
02H Reserved* 
03H Reserved* 
04H Write Through (WT) 
O5H Write Protected (WP) 
O6H Write Back (WB) 
07H Uncached (UC-) 
O8H - FFH Reserved* 


NOTE: 
* Using these encodings will result in a general-protection exception (#GP). 


12-34 Vol. 3A 


MEMORY CACHE CONTROL 


12.12.3 Selecting a Memory Type from the PAT 


To select a memory type for a page from the PAT, a 3-bit index made up of the PAT, PCD, and PWT bits must be 
encoded in the page-table or page-directory entry for the page. Table 12-11 shows the possible encodings of the 
PAT, PCD, and PWT bits and the PAT entry selected with each encoding. The PAT bit is bit 7 in page-table entries that 
point to 4-KByte pages and bit 12 in paging-structure entries that point to larger pages. The PCD and PWT bits are 
bits 4 and 3, respectively, in paging-structure entries that point to pages of any size. 


The PAT entry selected for a page is used in conjunction with the MTRR setting for the region of physical memory 
in which the page is mapped to determine the effective memory type for the page, as shown in Table 12-7. 


Table 12-11. Selection of PAT Entries with PAT, PCD, and PWT Flags 


PAT PCD PWT PAT Entry 
0 0 0 PATO 
0 0 1 PAT1 
0 1 0 PAT2 
0 1 1 PAT3 
1 0 0 PAT4 
1 0 1 PAT5 
1 1 0 PAT6 
1 1 1 PAT7 


12.12.4 Programming the PAT 


Table 12-12 shows the default setting for each PAT entry following a power up or reset of the processor. The setting 
remain unchanged following a soft reset (INIT reset). 


Table 12-12. Memory Type Setting of PAT Entries Following a Power-up or Reset 


PAT Entry Memory Type Following Power-up or Reset 
PATO WB 
PAT1 WT 
PAT2 UC- 
PAT3 UC 
PAT4 WB 
PATS WT 
PAT6 UC- 
PAT7 UC 


The values in all the entries of the PAT can be changed by writing to the IA32_PAT MSR using the WRMSR instruc- 
tion. The IA32_PAT MSR is read and write accessible (use of the RDMSR and WRMSR instructions, respectively) to 
software operating at a CPL of 0. Table 12-10 shows the allowable encoding of the entries in the PAT. Attempting to 
write an undefined memory type encoding into the PAT causes a general-protection (#GP) exception to be gener- 
ated. 


The operating system (OS) is responsible for ensuring that changes to a PAT entry occur in a manner that main- 
tains the consistency of the processor caches and translation lookaside buffers (TLB). It requires the OS to invali- 
date all affected TLB entries (including global entries) and all entries in all paging-structure caches. It may also 
require flushing of the processor caches in certain situations. This can be accomplished in various ways, including 
the sequence below or by following the procedure specified in Section 12.11.8, “MTRR Considerations in MP 
Systems.” (See Section 4.10.4, “Invalidation of TLBs and Paging-Structure Caches” for additional background 
information.) Also note that in a multi-processor environment, it is the software's responsibility to resolve differ- 
ences in conflicting memory types across logical processors that may arise from changes to the PAT (e.g., if two 
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logical processors map a linear address to the same physical address but have PATs that specify a different memory 
type for that physical address). 


Example of a sequence to invalidate the processor TLBs and caches (if necessary): 


1. If the PCIDE or PGE flag is set in CR4, flush TLBs by clearing one of those flags (then restore the flag via a 
subsequent CR4 write). 


Otherwise, flush TLBs by executing a MOV from control register CR3 to another register and then a MOV from 
that register back to CR3. 


2. Inthe case that there are changes to memory-type mappings for which cache self-snooping behavior would be 
problematic given the existing mappings (e.g., changing a cache line's memory type from WB to UC to be used 
for memory-mapped I/O), then cache flushing is also required. This can be done by executing CLFLUSH 
operations for all affected cache lines or by executing the WBINVD instruction (recommended only if there are 
a large number of affected mappings or if it is unknown which mappings are affected). 


The PAT allows any memory type to be specified in the page tables, and therefore it is possible to have a single 
physical page mapped to two or more different linear addresses, each with different memory types. Intel does not 
support this practice because it may lead to undefined operations that can result in a system failure. In particular, 
a WC page must never be aliased to a cacheable page because WC writes may not check the processor caches. 


When remapping a page that was previously mapped as a cacheable memory type to a WC page, an operating 
system can avoid this type of aliasing by doing the following: 


1. Remove the previous mapping to a cacheable memory type in the page tables; that is, make them not 
present. 


Flush the TLBs of processors that may have used the mapping, even speculatively. 
Create a new mapping to the same physical address with a new memory type, for instance, WC. 


Flush the caches on all processors that may have used the mapping previously. Note on processors that support 
self-snooping, CPUID feature flag bit 27, this step is unnecessary. 


Operating systems that use a page directory as a page table (to map large pages) and enable page size extensions 
must carefully scrutinize the use of the PAT index bit for the 4-KByte page-table entries. The PAT index bit for a 
page-table entry (bit 7) corresponds to the page size bit in a page-directory entry. Therefore, the operating system 
can only use PAT entries PAO through PA3 when setting the caching type for a page table that is also used as a page 
directory. If the operating system attempts to use PAT entries PA4 through PA7 when using this memory as a page 
table, it effectively sets the PS bit for the access to this memory as a page directory. 


For compatibility with earlier IA-32 processors that do not support the PAT, care should be taken in selecting the 
encodings for entries in the PAT (see Section 12.12.5, “PAT Compatibility with Earlier IA-32 Processors”). 


12.12.5 PAT Compatibility with Earlier IA-32 Processors 


For IA-32 processors that support the PAT, the IA32_PAT MSR is always active. That is, the PCD and PWT bits in 
page-table entries and in page-directory entries (that point to pages) are always select a memory type for a page 
indirectly by selecting an entry in the PAT. They never select the memory type for a page directly as they do in 
earlier IA-32 processors that do not implement the PAT (see Table 12-6). 


To allow compatibility for code written to run on earlier IA-32 processor that do not support the PAT, the PAT mech- 
anism has been designed to allow backward compatibility to earlier processors. This compatibility is provided 
through the ordering of the PAT, PCD, and PWT bits in the 3-bit PAT entry index. For processors that do not imple- 
ment the PAT, the PAT index bit (bit 7 in the page-table entries and bit 12 in the page-directory entries) is reserved 
and set to 0. With the PAT bit reserved, only the first four entries of the PAT can be selected with the PCD and PWT 
bits. At power-up or reset (see Table 12-12), these first four entries are encoded to select the same memory types 
as the PCD and PWT bits would normally select directly in an IA-32 processor that does not implement the PAT. So, 
if encodings of the first four entries in the PAT are left unchanged following a power-up or reset, code written to run 
on earlier IA-32 processors that do not implement the PAT will run correctly on IA-32 processors that do implement 
the PAT. 


12-36 Vol. 3A 


12.Updates to Chapter 16, Volume 3B 


Change bars and violet text show changes to Chapter 16 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3B: System Programming Guide, Part 2. 


Changes to this chapter: 

e Updated Section 16.3.1.2, “IA32_MCG_STATUS MSR,” to clarify that writing to any of the IA32_MCG_STATUS 
MSR's reserved bits with a value other than 0 would result in #GP. Previously, the word “reserved” was not 
specified here. 

e Updated Section 16.3.2.2.1, “Overwrite Rules for Machine Check Overflow,” to clarify that the overwrite rules 
are not limited to cache events. 
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CHAPTER 16 
MACHINE-CHECK ARCHITECTURE 


This chapter describes the machine-check architecture and machine-check exception mechanism found in the 
Pentium 4, Intel Xeon, Intel Atom, and P6 family processors. See Chapter 6, “Interrupt 18—Machine-Check Excep- 
tion (#MC),” for more information on machine-check exceptions. A brief description of the Pentium processor’s 
machine check capability is also given. 


Additionally, a signaling mechanism for software to respond to hardware corrected machine check error is covered. 


16.1 MACHINE-CHECK ARCHITECTURE 


The Pentium 4, Intel Xeon, Intel Atom, and P6 family processors implement a machine-check architecture that 
provides a mechanism for detecting and reporting hardware (machine) errors, such as: system bus errors, ECC 
errors, parity errors, cache errors, and TLB errors. It consists of a set of model-specific registers (MSRs) that are 
used to set up machine checking and additional banks of MSRs used for recording errors that are detected. 


The processor signals the detection of an uncorrected machine-check error by generating a machine-check excep- 
tion (#MC), which is an abort class exception. The implementation of the machine-check architecture does not 
ordinarily permit the processor to be restarted reliably after generating a machine-check exception. However, the 
machine-check-exception handler can collect information about the machine-check error from the machine-check 
MSRs. 


Starting with 45 nm Intel 64 processor on which CPUID reports DisplayFamily_DisplayModel as O6H_1AH; see the 
CPUID instruction in Chapter 3, “Instruction Set Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 2A. The processor can report information on corrected machine-check errors and 
deliver a programmable interrupt for software to respond to MC errors, referred to as corrected machine-check 
error interrupt (CMCI). See Section 16.5 for details. 


Intel 64 processors supporting machine-check architecture and CMCI may also support an additional enhance- 
ment, namely, support for software recovery from certain uncorrected recoverable machine check errors. See 
Section 16.6 for details. 


16.2 COMPATIBILITY WITH PENTIUM PROCESSOR 


The Pentium 4, Intel Xeon, Intel Atom, and P6 family processors support and extend the machine-check exception 
mechanism introduced in the Pentium processor. The Pentium processor reports the following machine-check 
errors: 


° Data parity errors during read cycles. 
¢ Unsuccessful completion of a bus cycle. 
The above errors are reported using the PS_MC_TYPE and P5_MC_ADDR MSRs (implementation specific for the 


Pentium processor). Use the RDMSR instruction to read these MSRs. See Chapter 2, “Model-Specific Registers 
(MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for the addresses. 


The machine-check error reporting mechanism that Pentium processors use is similar to that used in Pentium 4, 
Intel Xeon, Intel Atom, and P6 family processors. When an error is detected, it is recorded in PS_MC_TYPE and 
P5_MC_ADDR; the processor then generates a machine-check exception (#MC). 


See Section 16.3.3, “Mapping of the Pentium Processor Machine-Check Errors to the Machine-Check Architecture,” 
and Section 16.10.2, “Pentium Processor Machine-Check Exception Handling,” for information on compatibility 
between machine-check code written to run on the Pentium processors and code written to run on P6 family 
processors. 
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16.3. MACHINE-CHECK MSRS 


Machine check MSRs in the Pentium 4, Intel Atom, Intel Xeon, and P6 family processors consist of a set of global 
control and status registers and several error-reporting register banks. See Figure 16-1. 


Global Control MSRs Error-Reporting Bank Registers 
(One Set for Each Hardware Unit) 
63 0 63 (0) 
IA32_MCG_CAP MSR IA32_MCi_CTL MSR 
63 0 63 0 
IA32_MCG_STATUS MSR IA32_MCi_STATUS MSR 
63 0 63 0 
IA32_MCG_CTL MSR 1A32_MCi_ADDR MSR 
63 0 63 0 
IA32_MCG_EXT_CTL MSR IA32_MCi_MISC MSR 
63 0 
IA32_MCi_CTL2 MSR 


Figure 16-1. Machine-Check MSRs 


Each error-reporting bank is associated with a specific hardware unit (or group of hardware units) in the processor. 
Use RDMSR and WRMSR to read and to write these registers. 


16.3.1 Machine-Check Global Control MSRs 


The machine-check global control MSRs include the IA32_MCG_CAP, IA32_MCG_STATUS, and optionally IA32_MC- 
G_CTL and IA32_MCG_EXT_CTL. See Chapter 2, “Model-Specific Registers (MSRs),” in the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 4, for the addresses of these registers. 


16.3.1.1 IA32_MCG_CAP MSR 


The IA32_MCG_CAP MSR is a read-only register that provides information about the machine-check architecture of 
the processor. Figure 16-2 shows the layout of the register. 
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63 27 26 25 2423 1615 1211109 8 7 0 


Reserved Count 


MCG_LMCE_P[27] ——— 
MCG_ELOG P[26] 


MCG_EMC_P[25] 
MCG_SER P[24] 
MCG_EXT_CNT[23:16] 
MCG_TES P[11] 
MCG_CMCI_P[10] 
MCG_EXT_P[9] 
MCG_CTL_P[8] 


Figure 16-2. [A32_MCG_CAP Register 


Where: 


Count field, bits 7:0 — Indicates the number of hardware unit error-reporting banks available in a particular 
processor implementation. 


MCG_CTL_P (control MSR present) flag, bit 8 — Indicates that the processor implements the IA32_MC- 
G_CTL MSR when set; this register is absent when clear. 


MCG_EXT_P (extended MSRs present) flag, bit 9 — Indicates that the processor implements the extended 
machine-check state registers found starting at MSR address 180H; these registers are absent when clear. 


MCG_CMCI_P (Corrected MC error counting/signaling extension present) flag, bit 10 — Indicates 
(when set) that extended state and associated MSRs necessary to support the reporting of an interrupt on a 
corrected MC error event and/or count threshold of corrected MC errors, is present. When this bit is set, it does 
not imply this feature is supported across all banks. Software should check the availability of the necessary 
logic on a bank by bank basis when using this signaling capability (i.e., bit 30 settable in individual IA32_M- 
Ci_CTL2 register). 


MCG_TES_P (threshold-based error status present) flag, bit 11 — Indicates (when set) that bits 56:53 
of the IA32_MCi_STATUS MSR are part of the architectural space. Bits 56:55 are reserved, and bits 54:53 are 
used to report threshold-based error status. Note that when MCG_TES_P is not set, bits 56:53 of the IA32_M- 
Ci_STATUS MSR are model-specific. 


MCG_EXT_CNT, bits 23:16 — Indicates the number of extended machine-check state registers present. This 
field is meaningful only when the MCG_EXT_P flag is set. 


MCG_SER_P (software error recovery support present) flag, bit 24 — Indicates (when set) that the 
processor supports software error recovery (see Section 16.6), and IA32_MCi_STATUS MSR bits 56:55 are 
used to report the signaling of uncorrected recoverable errors and whether software must take recovery 
actions for uncorrected errors. Note that when MCG_TES_Pis not set, bits 56:53 of the IA32_MCi_STATUS MSR 
are model-specific. If MCG_TES_P is set but MCG_SER_P is not set, bits 56:55 are reserved. 


MCG_EMC_P (Enhanced Machine Check Capability) flag, bit 25 — Indicates (when set) that the 
processor supports enhanced machine check capabilities for firmware first signaling. 


MCG_ELOG_P (extended error logging) flag, bit 26 — Indicates (when set) that the processor allows 
platform firmware to be invoked when an error is detected so that it may provide additional platform specific 
information in an ACPI format “Generic Error Data Entry” that augments the data included in machine check 
bank registers. 


For additional information about extended error logging interface, see 
https://cdrdv2.intel.com/v1/dl/getContent/671064. 


MCG_LMCE_P (local machine check exception) flag, bit 27 — Indicates (when set) that the following 
interfaces are present: 
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— an extended state LMCE_S (located in bit 3 of IA32_MCG_STATUS), and 
— the IA32_MCG_EXT_CTL MSR, necessary to support Local Machine Check Exception (LMCE). 


A non-zero MCG_LMCE_P indicates that, when LMCE is enabled as described in Section 16.3.1.5, some machine 
check errors may be delivered to only a single logical processor. 


The effect of writing to the IA32_MCG_CAP MSR is undefined. 


16.3.1.2 IA32_MCG_STATUS MSR 


The IA32_MCG_STATUS MSR describes the current state of the processor after a machine-check exception has 
occurred (see Figure 16-3). 


63 3 


Reserved 


LMCE_S—Local machine check exception ee 
MCIP—Machine check in progress flag 


EIPV—Error IP valid flag 
RIPV—Restart IP valid flag 


V—-OZ|N 


<U-mM]/— 
<U-D/OC 


Figure 16-3. IA32_MCG_STATUS Register 


Where: 


° RIPV (restart IP valid) flag, bit O — Indicates (when set) that program execution can be restarted reliably 
at the instruction pointed to by the instruction pointer pushed on the stack when the machine-check exception 
is generated. When clear, the program cannot be reliably restarted at the pushed instruction pointer. 


¢ EIPV (error IP valid) flag, bit 1 — Indicates (when set) that the instruction pointed to by the instruction 
pointer pushed onto the stack when the machine-check exception is generated is directly associated with the 
error. When this flag is cleared, the instruction pointed to may not be associated with the error. 


¢ MCIP (machine check in progress) flag, bit 2 — Indicates (when set) that a machine-check exception was 
generated. Software can set or clear this flag. The occurrence of a second Machine-Check Event while MCIP is 
set will cause the processor to enter a shutdown state. For information on processor behavior in the shutdown 
state, please refer to the description in Chapter 6, “Interrupt and Exception Handling”: “Interrupt 8—Double 
Fault Exception (#DF)”. 


¢ LMCE_S (local machine check exception signaled), bit 3 — Indicates (when set) that a local machine- 
check exception was generated. This indicates that the current machine-check event was delivered to only this 
logical processor. 


Bits 63:04 in the IA32_MCG_STATUS MSR are reserved. An attempt to write to the IA32_MCG_STATUS MSR’s 
reserved bits with any value other than 0 results in #GP. 


16.3.1.3. IA32_MCG_CTL MSR 
The IA32_MCG_CTL MSR is present if the capability flag MCG_CTL_P is set in the IA32_MCG_CAP MSR. 


IA32_MCG_CTL controls the reporting of machine-check exceptions. If present, writing 1s to this register enables 
machine-check features and writing all Os disables machine-check features. All other values are undefined and/or 
implementation specific. 


16.3.1.4 IA32_MCG_EXT_CTL MSR 
The IA32_MCG_EXT_CTL MSR is present if the capability flag MCG_LMCE_P is set in the IA32_MCG_CAP MSR. 
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IA32_MCG_EXT_CTL.LMCE_EN (bit 0) allows the processor to signal some MCEs to only a single logical processor 
in the system. 


If MCG_LMCE_P is not set in IA32_MCG_CAP, or platform software has not enabled LMCE by setting IA32_FEA- 
TURE_CONTROL.LMCE_ENABLED (bit 20), any attempt to write or read IA32_MCG_EXT_CTL will result in #GP. 


The IA32_MCG_EXT_CTL MSR is cleared on RESET. 
Figure 16-4 shows the layout of the IA32_MCG_EXT_CTL register 


63 1.0 


Reserved 


LMCE_EN - system software control to enable/disable LMCE 


Figure 16-4. I|A32_MCG_EXT_CTL Register 


where 


¢ LMCE_EN (local machine check exception enable) flag, bit O - System software sets this to allow 
hardware to signal some MCEs to only a single logical processor. System software can set LMCE_EN only if the 
platform software has configured IA32_FEATURE_CONTROL as described in Section 16.3.1.5. 


16.3.1.5 Enabling Local Machine Check 


The intended usage of LMCE requires proper configuration by both platform software and system software. Plat- 
form software can turn LMCE on by setting bit 20 (LMCE_ENABLED) in IA32_FEATURE_CONTROL MSR (MSR 
address 3AH). 


System software must ensure that both IA32_FEATURE_CONTROL.Lock (bit 0)and IA32_FEATURE_CON- 
TROL.LMCE_ENABLED (bit 20) are set before attempting to set IA32_MCG_EXT_CTL.LMCE_EN (bit 0). When 
system software has enabled LMCE, then hardware will determine if a particular error can be delivered only to a 
single logical processor. Software should make no assumptions about the type of error that hardware can choose 
to deliver as LMCE. The severity and override rules stay the same as described in Table 16-8 to determine the 
recovery actions. 


16.3.2 €rror-Reporting Register Banks 


Each error-reporting register bank can contain the IA32_MCi_CTL, IA32_MCi_STATUS, IA32_MCi_ADDR, and 
IA32_MCi_MISC MSRs. The number of reporting banks is indicated by bits [7:0] of IA32_MCG_CAP MSR (address 
0179H). The first error-reporting register (IA32_MCO_CTL) always starts at address 400H. 


See Chapter 2, “Model-Specific Registers (MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 4, for addresses of the error-reporting registers in the Pentium 4, Intel Atom, and Intel Xeon 
processors; and for addresses of the error-reporting registers P6 family processors. 


16.3.2.1  IA32_MCi_CTL MSRs 


The IA32_MCi_CTL MSR controls signaling of #MC for errors produced by a particular hardware unit (or group of 
hardware units). Each of the 64 flags (EEj) represents a potential error. Setting an EEj flag enables signaling #MC 
of the associated error and clearing it disables signaling of the error. Error logging happens regardless of the setting 
of these bits. The processor drops writes to bits that are not implemented. Figure 16-5 shows the bit fields of 
IA32_MCi_CTL. 
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63 62 61 3210 
E E 

6616/6 e e e e e 0lolo 
3/2/1 2/1|0 


EEj—Error reporting enable flag 
(where j is 00 through 63) 


16.3.2 


Figure 16-5. IA32_MCi_CTL Register 


NOTE 


For P6 family processors, processors based on Intel Core microarchitecture (excluding those on 
which CPUID reports DisplayFamily_DisplayModel as O6H_1AH and onward): the operating system 
or executive software must not modify the contents of the IA32_MCO_CTL MSR. This MSR is 
internally aliased to the EBL_CR_POWERON MSR and controls platform-specific error handling 
features. System specific firmware (the BIOS) is responsible for the appropriate initialization of the 
IA32_MCO_CTL MSR. P6 family processors only allow the writing of all 1s or all Os to the IA32_M- 
Ci_CTL MSR. 


.2 1A32_MCi_STATUS MSRS 


Each IA32_MCi_STATUS MSR contains information related to a machine-check error if its VAL (valid) flag is set (see 
Figure 16-6). Software is responsible for clearing IA32_MCi_STATUS MSRs by explicitly writing Os to them; writing 
1s to them causes a general-protection exception. 


Where: 


NOTE 


Figure 16-6 depicts the IA32_MCi_STATUS MSR when IA32_MCG_CAP[24] = 1, IA32_MC- 
G_CAP[11] = 1 and IA32_MCG_CAP[10] = 1. When IA32_MCG_CAP[24] = 0 and IA32_MC- 
G_CAP[11] = 1, bits 56:55 is reserved and bits 54:53 for threshold-based error reporting. When 
IA32_MCG_CAP[11] = 0, bits 56:53 are part of the “Other Information” field. The use of bits 54:53 
for threshold-based error reporting began with Intel Core Duo processors, and is currently used for 
cache memory. See Section 16.4, “Enhanced Cache Error reporting,” for more information. When 
IA32_MCG_CAP[10] = 0, bits 52:38 are part of the “Other Information” field. The use of bits 52:38 
for corrected MC error count is introduced with Intel 64 processor on which CPUID reports Display- 
Family_DisplayModel as O6H_1AH. 


® MCA (machine-check architecture) error code field, bits 15:0 — Specifies the machine-check archi- 
tecture-defined error code for the machine-check error condition detected. The machine-check architecture- 
defined error codes are guaranteed to be the same for all IA-32 processors that implement the machine-check 
architecture. See Section 16.9, “Interpreting the MCA Error Codes,” and Chapter 17, “Interpreting Machine 
Check Error Codes,” for information on machine-check error codes. 


° Model-specific error code field, bits 31:16 — Specifies the model-specific error code that uniquely 
identifies the machine-check error condition detected. The model-specific error codes may differ among IA-32 
processors for the same machine-check error condition. See Chapter 17, “Interpreting Machine Check Error 
Codes,” for information on model-specific error codes. 


® Reserved, Error Status, and Other Information fields, bits 56:32 — 
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¢ If IA32_MCG_CAP.MCG_EMC_P[bit 25] is 0, bits 37:32 contain “Other Information” that is implemen- 
tation-specific and is not part of the machine-check architecture. 


¢ If IA832_MCG_CAP.MCG_EMC_P is 1, “Other Information” is in bits 36:32. If bit 37 is 0, system firmware 
has not changed the contents of IA32_MCi_STATUS. If bit 37 is 1, system firmware may have edited the 
contents of IA32_MCi_STATUS. 


¢ If IA32_MCG_CAP.MCG_CMCI_P[bit 10] is 0, bits 52:38 also contain “Other Information” (in the same 
sense as bits 37:32). 
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63 62 61 60 59 58 57 56 55 54 53 52 3837 36 32 31 1615 0 
: 7 a ; y s - Corrected Error Other | MSCOD Model MCA Error Code 
tle C Count Info | Specific Error Code 

R 


|__ Firmware updated error status indicator (37)* 
Threshold-based error status (54:53)** 

AR — Recovery action required for UCR error (55)*** 

S — Signaling an uncorrected recoverable (UCR) error (56)*** 

PCC — Processor context corrupted (57) 

ADDRV — MCi_ADDR register valid (58) 

MISCV — MCi_MISC register valid (59) 

EN — Error reporting enabled (60) 

UC — Uncorrected error (61) 

OVER — Error overflow (62) 

VAL — MCi_STATUS register valid (63) 


* When IA32_MCG_CAP[25] (MCG_EMC_P) is set, bit 37 is not part of “Other Information’. 


** When IA32_MCG_CAP[11] (MCG_TES_P) is not set, these bits are model-specific 
(part of “Other Information’). 


*** When IA32_MCG_CAP[11] or [A32_MCG_CAP[24] are not set, these bits are reserved, or 
model-specific (part of “Other Information”). 


Figure 16-6. [A32_MCi_STATUS Register 


¢ If IA32_MCG_CAP[10] is 1, bits 52:38 are architectural (not model-specific). In this case, bits 52:38 
reports the value of a 15 bit counter that increments each time a corrected error is observed by the MCA 
recording bank. This count value will continue to increment until cleared by software. The most 
significant bit, 52, is a sticky count overflow bit. 


¢ If IA32_MCG_CAP[11] is 0, bits 56:53 also contain “Other Information” (in the same sense). 


¢ If IA32_MCG_CAP[11] is 1, bits 56:53 are architectural (not model-specific). In this case, bits 56:53 
have the following functionality: 


¢ If IA32_MCG_CAP[24] is 0, bits 56:55 are reserved. 
¢ If IA32_MCG_CAP[24] is 1, bits 56:55 are defined as follows: 


¢ — S (Signaling) flag, bit 56 - Signals the reporting of UCR errors in this MC bank. See Section 16.6.2 
for additional details. 


° AR (Action Required) flag, bit 55 - Indicates (when set) that MCA error code specific recovery 
action must be performed by system software at the time this error was signaled. See Section 
16.6.2 for additional details. 


¢ If the UC bit (Figure 16-6) is 1, bits 54:53 are undefined. 


¢ If the UC bit (Figure 16-6) is 0, bits 54:53 indicate the status of the hardware structure that 
reported the threshold-based error. See Table 16-1. 


Table 16-1. Bits 54:53 in IA32_MCi_STATUS MSRs when IA32_MCG_CAP[11] = 1 and UC = 0 


Bits 54:53 | Meaning 


00 No tracking - No hardware status tracking is provided for the structure reporting this event. 


01 Green - Status tracking is provided for the structure posting the event; the current status is green (below threshold). 
For more information, see Section 16.4, “Enhanced Cache Error reporting.” 


10 Yellow - Status tracking is provided for the structure posting the event; the current status is yellow (above threshold). 
For more information, see Section 16.4, “Enhanced Cache Error reporting.” 


11 Reserved 
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¢ PCC (processor context corrupt) flag, bit 57 — Indicates (when set) that the state of the processor might 
have been corrupted by the error condition detected and that reliable restarting of the processor may not be 
possible. When clear, this flag indicates that the error did not affect the processor's state, and software may be 
able to restart. When system software supports recovery, consult Section 16.10.4, “Machine-Check Software 
Handler Guidelines for Error Recovery,” for additional rules that apply. 


¢ ADDRV (IA32_MCi_ADDR register valid) flag, bit 58 — Indicates (when set) that the IA32_MCi_ADDR 
register contains the address where the error occurred (see Section 16.3.2.3, “IA32_MCi_ADDR MSRs”). When 
clear, this flag indicates that the IA32_MCi_ADDR register is either not implemented or does not contain the 
address where the error occurred. Do not read these registers if they are not implemented in the processor. 


° MISCV (IA32_MCi_MISC register valid) flag, bit 59 — Indicates (when set) that the IA32_MCi_MISC 
register contains additional information regarding the error. When clear, this flag indicates that the IA32_M- 
Ci_MISC register is either not implemented or does not contain additional information regarding the error. Do 
not read these registers if they are not implemented in the processor. 


¢ EN (error enabled) flag, bit 60 — Indicates (when set) that the error was enabled by the associated EEj bit 
of the IA32_MCi_CTL register. 


¢ UC (error uncorrected) flag, bit 61 — Indicates (when set) that the processor did not or was not able to 
correct the error condition. When clear, this flag indicates that the processor was able to correct the error 
condition. 


¢ OVER (machine check overflow) flag, bit 62 — Indicates (when set) that a machine-check error occurred 
while the results of a previous error were still in the error-reporting register bank (that is, the VAL bit was 
already set in the IA32_MCi_STATUS register). The processor sets the OVER flag and software is responsible for 
clearing it. In general, enabled errors are written over disabled errors, and uncorrected errors are written over 
corrected errors. Uncorrected errors are not written over previous valid uncorrected errors. When 
MCG_CMCI_P is set, corrected errors may not set the OVER flag. Software can rely on corrected error count in 
IA32_MCi_Status[52:38] to determine if any additional corrected errors may have occurred. For more infor- 
mation, see Section 16.3.2.2.1, “Overwrite Rules for Machine Check Overflow.” 


° VAL (IA32_MCi_STATUS register valid) flag, bit 63 — Indicates (when set) that the information within the 
IA32_MCi_STATUS register is valid. When this flag is set, the processor follows the rules given for the OVER flag 
in the IA32_MCi_STATUS register when overwriting previously valid entries. The processor sets the VAL flag 
and software is responsible for clearing it. 


16.3.2.2.1 Overwrite Rules for Machine Check Overflow 


Table 16-2 shows the overwrite rules for how to treat a second event if the MC bank already contains a valid log 
from an earlier event — that is, what to do if the valid bit for an MC bank already is set to 1. When more than one 
structure posts events in a given bank, these rules specify whether a new event will overwrite a previous posting or 
not. These rules define a priority for uncorrected (highest priority), yellow, and green/unmonitored (lowest 
priority) status. 


In Table 16-2, the values in the two left-most columns are IA32_MCi_STATUS[54:53]. 


Table 16-2. Overwrite Rules for Enabled Errors 
First Event Second Event UC bit Color MCA Info 
00/green 00/green 0 00/green either 
00/green yellow 0 yellow second error 
yellow 00/green 6) yellow first error 
yellow yellow 0 yellow either 
00/green/yellow UC 1 undefined second 
UC 00/green/yellow 1 undefined first 


If a second event overwrites a previously posted event, the information (as guarded by individual valid bits) in the 
MCi bank is entirely from the second event. Similarly, if a first event is retained, all of the information previously 
posted for that event is retained. In general, when the logged error or the recent error is a corrected error, the 
OVER bit (MCi_Status[62]) may be set to indicate an overflow. When MCG_CMCI_P is set in IA32_MCG_CAP, 
system software should consult IA32_MCi_STATUS[52:38] to determine if additional corrected errors may have 
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occurred. Software may re-read IA32_MCi_STATUS, IA32_MCi_ADDR, and IA32_MCi_MISC appropriately to 
ensure data collected represent the last error logged. 

After software polls a posting and clears the register, the valid bit is no longer set and therefore the meaning of the 
rest of the bits, including the yellow/green/OO status field in bits 54:53, is undefined. The yellow/green indication 
will only be posted for events associated with monitored structures - otherwise the unmonitored (00) code will be 
posted in IA32_MCi_STATUS[54:53]. 


16.3.2.3 IA32_MCi_ADDR MSRs 


The IA32_MCi_ADDR MSR contains the address of the code or data memory location that produced the machine- 
check error if the ADDRV flag in the IA32_MCi_STATUS register is set (see Section 16-7, “IA32_MCi_ADDR MSR”). 
The IA32_MCi_ADDR register is either not implemented or contains no address if the ADDRV flag in the IA32_M- 
Ci_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will cause a 
general protection exception. 

The address returned is an offset into a segment, linear address, or physical address. This depends on the error 
encountered. When these registers are implemented, these registers can be cleared by explicitly writing Os to 
these registers. Writing 1s to these registers will cause a general-protection exception. See Figure 16-7. 


Processor Without Support For Intel 64 Architecture 
63 36 35 0 


Reserved Address 


Processor With Support for Intel 64 Architecture 
63 0 


Address" 


* Useful bits in this field depend on the address methodology in use when the 
the register state is saved. 


Figure 16-7. [A32_MCi_ADDR MSR 


16.3.2.4 IA32_MCi_MISC MSRs 


The IA32_MCi_MISC MSR contains additional information describing the machine-check error if the MISCV flag in 
the IA32_MCi_STATUS register is set. The IA32_MCi_MISC_MSR is either not implemented or does not contain 
additional information if the MISCV flag in the IA32_MCi_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general protection exception. 
When implemented in a processor, these registers can be cleared by explicitly writing all Os to them; writing 1s to 
them causes a general-protection exception to be generated. This register is not implemented in any of the error- 
reporting register banks for the P6 or Intel Atom family processors. 


If both MISCV and IA32_MCG_CAP[24] are set, the IA32_MCi_MISC_MSR is defined according to Figure 16-8 to 
support software recovery of uncorrected errors (see Section 16.6). 
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63 98 65 0 


Model Specific Information 


Address Mode 
Recoverable Address LSB 


Figure 16-8. UCR Support in [A32_MCi_MISC Register 


° Recoverable Address LSB (bits 5:0): The lowest valid recoverable address bit. Indicates the position of the least 
significant bit (LSB) of the recoverable error address. For example, if the processor logs bits [43:9] of the 
address, the LSB sub-field in IA32_MCi_MISC is 01001b (9 decimal). For this example, bits [8:0] of the 
recoverable error address in IA32_MCi_ADDR should be ignored. 

e Address Mode (bits 8:6): Address mode for the address logged in IA32_MCi_ADDR. The supported address 
modes are given in Table 16-3. 


Table 16-3. Address Mode in IA32_MCi_MISC[8:6] 


1A32_MCi_MISC[8:6] Encoding Definition 
000 Segment Offset 
001 Linear Address 
010 Physical Address 
011 Memory Address 
100 to 110 Reserved 
111 Generic 


¢ Model Specific Information (bits 63:9): Not architecturally defined. 


16.3.2.4.2 IOMCA 


Logging and Signaling of errors from PCI Express domain is governed by PCI Express Advanced Error Reporting 
(AER) architecture. PCI Express architecture divides errors in two categories: Uncorrectable errors and Correctable 
errors. Uncorrectable errors can further be classified as Fatal or Non-Fatal. Uncorrected IO errors are signaled to 
the system software either as AER Message Signaled Interrupt (MSI) or via platform specific mechanisms such as 
NMI. Generally, the signaling mechanism is controlled by BIOS and/or platform firmware. Certain processors 
support an error handling mode, called IOMCA mode, where Uncorrected PCI Express errors are signaled in the 
form of machine check exception and logged in machine check banks. 


When a processor is in this mode, Uncorrected PCI Express errors are logged in the MCACOD field of the IA32_M- 
Ci_STATUS register as Generic I/O error. The corresponding MCA error code is defined in Table 15-8. IA32_M- 
Ci_Status [15:0] Simple Error Code Encoding. Machine check logging complements and does not replace AER 
logging that occurs inside the PCI Express hierarchy. The PCI Express Root Complex and Endpoints continue to log 
the error in accordance with PCI Express AER mechanism. In IOMCA mode, MCi_MISC register in the bank that 
logged IOMCA can optionally contain information that link the Machine Check logs with the AER logs or proprietary 
logs. In such a scenario, the machine check handler can utilize the contents of MCi_MISC to locate the next level of 
error logs corresponding to the same error. Specifically, if MCi_Status.MISCV is 1 and MCACOD is 0xOEOB, MCi_- 
MISC contains the PCI Express address of the Root Complex device containing the AER Logs. Software can consult 
the header type and class code registers in the Root Complex device's PCIe Configuration space to determine what 
type of device it is. This Root Complex device can either be a PCI Express Root Port, PCI Express Root Complex 
Event Collector or a proprietary device. 
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Errors that originate from PCI Express or Legacy Endpoints are logged in the corresponding Root Port in addition to 
the generating device. If MISCV=1 and MCi_MISC contains the address of the Root Port or a Root Complex Event 
collector, software can parse the AER logs to learn more about the error. 


If MISCV=1 and MCi_MISC points to a device that is neither a Root Complex Event Collector not a Root Port, soft- 
ware must consult the Vendor ID/Device ID and use device specific knowledge to locate and interpret the error log 
registers. In some cases, the Root Complex device configuration space may not be accessible to the software and 
both the Vendor and Device ID read as OxFFFF. 


¢ The format of MCi_MISC for IOMCA errors is shown in Table 16-4. 


Table 16-4. Address Mode in IA32_MCi_MISC[8:6] 


63:40 39:32 31:16 15:9 8:6 5:0 
RSVD PCI Express Segment PCI Express RSVD ADDR MODE" RECOV ADDR LSB" 
number Requestor ID 
NOTES: 


1. Not Applicable if ADDRV=0. 


Refer to PCI Express Specification 3.0 for definition of PCI Express Requestor ID and AER architecture. Refer to PCI 
Firmware Specification 3.0 for an explanation of PCI Ex-press Segment number and how software can access 
configuration space of a PCI Ex-press device given the segment number and Requestor ID. 


16.3.2.5 IA32_MCi_CTL2 MSRs 


The IA32_MCi_CTL2 MSR provides the programming interface to use corrected MC error signaling capability that is 
indicated by IA32_MCG_CAP[10] = 1. Software must check for the presence of IA32_MCi_CTL2 on a per-bank 
basis. 

When IA32_MCG_CAP[10] = 1, the IA32_MCi_CTL2 MSR for each bank exists, i.e., reads and writes to these MSR 
are supported. However, signaling interface for corrected MC errors may not be supported in all banks. 


The layout of IA32_MCi_CTL2 is shown in Figure 16-9. 


63 3130 29 15 14 0 


Reserved Reserved 


CMCI_EN—Enable/disable CMCI_ —~— 
Corrected error count threshold 


Figure 16-9. IA32_MCi_CTL2 Register 


¢ Corrected error count threshold, bits 14:0 — Software must initialize this field. The value is compared with 
the corrected error count field in IA32_MCi_STATUS, bits 38 through 52. An overflow event is signaled to the 
CMCI LVT entry (see Table 11-1) in the APIC when the count value equals the threshold value. The new LVT 
entry in the APIC is at O2FOH offset from the APIC_BASE. If CMCI interface is not supported for a particular 
bank (but IA32_MCG_CAP[10] = 1), this field will always read 0. 


¢ CMCI_EN (Corrected error interrupt enable/disable/indicator), bits 30 — Software sets this bit to 
enable the generation of corrected machine-check error interrupt (CMCI). If CMCI interface is not supported for 
a particular bank (but IA32_MCG_CAP[10] = 1), this bit is writeable but will always return O for that bank. This 
bit also indicates CMCI is supported or not supported in the corresponding bank. See Section 16.5 for details of 
software detection of CMCI facility. 
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Some microarchitectural sub-systems that are the source of corrected MC errors may be shared by more than one 
logical processors. Consequently, the facilities for reporting MC errors and controlling mechanisms may be shared 
by more than one logical processors. For example, the IA32_MCi_CTL2 MSR is shared between logical processors 
sharing a processor core. Software is responsible to program IA32_MCi_CTL2 MSR in a consistent manner with 
CMCI delivery and usage. 


After processor reset, IA32_MCi_CTL2 MSRs are zeroed. 


16.3.2.6 IA32_MCG Extended Machine Check State MSRs 


The Pentium 4 and Intel Xeon processors implement a variable number of extended machine-check state MSRs. 
The MCG_EXT_P flag in the IA32_MCG_CAP MSR indicates the presence of these extended registers, and the 
MCG_EXT_CNT field indicates the number of these registers actually implemented. See Section 16.3.1.1, 
“IA32_MCG_CAP MSR.” Also see Table 16-5. 


Table 16-5. Extended Machine Check State MSRs in Processors Without Support for Intel® 64 Architecture 


MSR Address Description 
IA32_MCG_EAX 180H Contains state of the EAX register at the time of the machine-check error. 
IA32_MCG_EBX 181H Contains state of the EBX register at the time of the machine-check error. 
IA32_MCG_ECX 182H Contains state of the ECX register at the time of the machine-check error. 
IA32_MCG_EDX 183H Contains state of the EDX register at the time of the machine-check error. 
IA32_MCG_ESI 184H Contains state of the ESI register at the time of the machine-check error. 
1A32_MCG_EDI 185H Contains state of the EDI register at the time of the machine-check error. 
IA32_MCG_EBP 186H Contains state of the EBP register at the time of the machine-check error. 
1A32_MCG_ESP 187H Contains state of the ESP register at the time of the machine-check error. 
IA32_MCG_EFLAGS 188H Contains state of the EFLAGS register at the time of the machine-check error. 
1A32_MCG_EIP 189H Contains state of the EIP register at the time of the machine-check error. 
IA32_MCG_MISC 18AH When set, indicates that a page assist or page fault occurred during DS normal 
operation. 


In processors with support for Intel 64 architecture, 64-bit machine check state MSRs are aliased to the legacy 
MSRs. In addition, there may be registers beyond IA32_MCG_MISC. These may include up to five reserved MSRs 
(IA32_MCG_RESERVED[1:5]) and save-state MSRs for registers introduced in 64-bit mode. See Table 16-6. 


Table 16-6. Extended Machine Check State MSRs In Processors With Support for Intel® 64 Architecture 


MSR Address Description 
IA32_MCG_RAX 180H Contains state of the RAX register at the time of the machine-check error. 
IA32_MCG_RBX 181H Contains state of the RBX register at the time of the machine-check error. 
IA32_MCG_RCX 182H Contains state of the RCX register at the time of the machine-check error. 
IA32_MCG_RDX 183H Contains state of the RDX register at the time of the machine-check error. 
IA32_MCG_RSI 184H Contains state of the RSI register at the time of the machine-check error. 
IA32_MCG_RDI 185H Contains state of the RDI register at the time of the machine-check error. 
IA32_MCG_RBP 186H Contains state of the RBP register at the time of the machine-check error. 
IA32_MCG_RSP 187H Contains state of the RSP register at the time of the machine-check error. 
IA32_MCG_RFLAGS 188H Contains state of the RFLAGS register at the time of the machine-check error. 
IA32_MCG_RIP 189H Contains state of the RIP register at the time of the machine-check error. 
IA32_MCG_MISC 18AH When set, indicates that a page assist or page fault occurred during DS normal 
operation. 


16-12 Vol. 3B 


MACHINE-CHECK ARCHITECTURE 


Table 16-6. Extended Machine Check State MSRs In Processors With Support for Intel® 64 Architecture (Contd.) 


MSR Address Description 

IA32_MCG_ 18BH- These registers, if present, are reserved. 

RSERVED[1:5] 18FH 

IA32_MCG_R8 190H Contains state of the R8 register at the time of the machine-check error. 
IA32_MCG_R9 191H Contains state of the R9 register at the time of the machine-check error. 
IA32_MCG_R10 192H Contains state of the R10 register at the time of the machine-check error. 
IA32_MCG_R11 193H Contains state of the R11 register at the time of the machine-check error. 
IA32_MCG_R12 194H Contains state of the R12 register at the time of the machine-check error. 
IA32_MCG_R13 195H Contains state of the R13 register at the time of the machine-check error. 
IA32_MCG_R14 196H Contains state of the R14 register at the time of the machine-check error. 
IA32_MCG_R15 197H Contains state of the R15 register at the time of the machine-check error. 


When a machine-check error is detected on a Pentium 4 or Intel Xeon processor, the processor saves the state of 
the general-purpose registers, the R/EFLAGS register, and the R/EIP in these extended machine-check state MSRs. 
This information can be used by a debugger to analyze the error. 


These registers are read/write to zero registers. This means software can read them; but if software writes to 
them, only all zeros is allowed. If software attempts to write a non-zero value into one of these registers, a general- 
protection (#GP) exception is generated. These registers are cleared on a hardware reset (power-up or RESET), 
but maintain their contents following a soft reset (INIT reset). 


16.3.3. Mapping of the Pentium Processor Machine-Check Errors to the Machine-Check 
Architecture 


The Pentium processor reports machine-check errors using two registers: PS_MC_TYPE and P5_MC_ADDR. The 
Pentium 4, Intel Xeon, Intel Atom, and P6 family processors map these registers to the IA32_MCi_STATUS and 

IA32_MCi_ADDR in the error-reporting register bank. This bank reports on the same type of external bus errors 
reported in PS_MC_TYPE and P5_MC_ADDR. 


The information in these registers can then be accessed in two ways: 


¢ By reading the IA32_MCi_STATUS and IA32_MCi_ADDR registers as part of a general machine-check exception 
handler written for Pentium 4, Intel Atom and P6 family processors. 


¢ By reading the P5_MC_TYPE and P5_MC_ADDR registers using the RDMSR instruction. 


The second capability permits a machine-check exception handler written to run on a Pentium processor to be run 
on a Pentium 4, Intel Xeon, Intel Atom, or P6 family processor. There is a limitation in that information returned by 
the Pentium 4, Intel Xeon, Intel Atom, and P6 family processors is encoded differently than information returned 
by the Pentium processor. To run a Pentium processor machine-check exception handler on a Pentium 4, Intel 
Xeon, Intel Atom, or P6 family processor; the handler must be written to interpret PS_MC_TYPE encodings 
correctly. 


16.4 ENHANCED CACHE ERROR REPORTING 


Starting with Intel Core Duo processors, cache error reporting was enhanced. In earlier Intel processors, cache 
status was based on the number of correction events that occurred in a cache. In the new paradigm, called 
“threshold-based error status”, cache status is based on the number of lines (ECC blocks) in a cache that incur 
repeated corrections. The threshold is chosen by Intel, based on various factors. If a processor supports threshold- 
based error status, it sets IA832_MCG_CAP[11] (MCG_TES_P) to 1; if not, to 0. 


A processor that supports enhanced cache error reporting contains hardware that tracks the operating status of 
certain caches and provides an indicator of their “health”. The hardware reports a “green” status when the number 
of lines that incur repeated corrections is at or below a pre-defined threshold, and a “yellow” status when the 
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number of affected lines exceeds the threshold. Yellow status means that the cache reporting the event is operating 
correctly, but you should schedule the system for servicing within a few weeks. 


Intel recommends that you rely on this mechanism for structures supported by threshold-base error reporting. 


The CPU/system/platform response to a yellow event should be less severe than its response to an uncorrected 
error. An uncorrected error means that a serious error has actually occurred, whereas the yellow condition is a 
warning that the number of affected lines has exceeded the threshold but is not, in itself, a serious event: the error 
was corrected and system state was not compromised. 


The green/yellow status indicator is not a foolproof early warning for an uncorrected error resulting from the failure 
of two bits in the same ECC block. Such a failure can occur and cause an uncorrected error before the yellow 
threshold is reached. However, the chance of an uncorrected error increases as the number of affected lines 
increases. 


16.5 CORRECTED MACHINE CHECK ERROR INTERRUPT 


Corrected machine-check error interrupt (CMCI) is an architectural enhancement to the machine-check architec- 
ture. It provides capabilities beyond those of threshold-based error reporting (Section 16.4). With threshold-based 
error reporting, software is limited to use periodic polling to query the status of hardware corrected MC errors. 
CMCI provides a signaling mechanism to deliver a local interrupt based on threshold values that software can 
program using the IA32_MCi_CTL2 MSRs. 


CMCI is disabled by default. System software is required to enable CMCI for each IA32_MCi bank that support the 
reporting of hardware corrected errors if IA32_MCG_CAP[10] = 1. 


System software use IA32_MCi_CTL2 MSR to enable/disable the CMCI capability for each bank and program 
threshold values into IA32_MCi_CTL2 MSR. CMCI is not affected by the CR4.MCE bit, and it is not affected by the 
IA32_MCi_CTL MSRs. 


To detect the existence of thresholding for a given bank, software writes only bits 14:0 with the threshold value. If 
the bits persist, then thresholding is available (and CMCI is available). If the bits are all O's, then no thresholding 
exists. To detect that CMCI signaling exists, software writes a 1 to bit 30 of the MCi_CTL2 register. Upon subsequent 
read, if bit 30 = 0, no CMCTI is available for this bank and no corrected or UCNA errors will be reported on this bank. 
If bit 30 = 1, then CMCTI is available and enabled. 


16.5.1 CMCI Local APIC Interface 
The operation of CMCI is depicted in Figure 16-10. 


Software write 1 to enable 


63 31 30 29 14 0 
MCi_CTL2 | | Error threshold 


~ Count overflow threshold -> CMCI LVT in local APIC 
| cca 
APIC_BASE + 2F0H 


MCi_STATUS Error count 


Figure 16-10. CMCI Behavior 


CMCI interrupt delivery is configured by writing to the LVT CMCI register entry in the local APIC register space at 
default address of APIC_BASE + 2FOH. A CMCI interrupt can be delivered to more than one logical processors if 
multiple logical processors are affected by the associated MC errors. For example, if a corrected bit error in a cache 
shared by two logical processors caused a CMCI, the interrupt will be delivered to both logical processors sharing 
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that microarchitectural sub-system. Similarly, package level errors may cause CMCI to be delivered to all logical 
processors within the package. However, system level errors will not be handled by CMCI. 


See Section 11.5.1, “Local Vector Table,” for details regarding the LVT CMCI register. 


16.5.2 System Software Recommendation for Managing CMCI and Machine Check Resources 


System software must enable and manage CMCI, set up interrupt handlers to service CMCI interrupts delivered to 
affected logical processors, program CMCI LVT entry, and query machine check banks that are shared by more 
than one logical processors. 

This section describes techniques system software can implement to manage CMCTI initialization, service CMCI 
interrupts in a efficient manner to minimize contentions to access shared MSR resources. 


16.5.2.1 CMCI Initialization 


Although a CMCI interrupt may be delivered to more than one logical processors depending on the nature of the 
corrected MC error, only one instance of the interrupt service routine needs to perform the necessary service and 
make queries to the machine-check banks. The following steps describes a technique that limits the amount of 
work the system has to do in response to a CMCI. 


° To provide maximum flexibility, system software should define per-thread data structure for each logical 
processor to allow equal-opportunity and efficient response to interrupt delivery. Specifically, the per-thread 
data structure should include a set of per-bank fields to track which machine check bank it needs to access in 
response to a delivered CMCI interrupt. The number of banks that needs to be tracked is determined by 
IA32_MCG_CAP[7:0]. 

¢ Initialization of per-thread data structure. The initialization of per-thread data structure must be done serially 
on each logical processor in the system. The sequencing order to start the per-thread initialization between 
different logical processor is arbitrary. But it must observe the following specific detail to satisfy the shared 
nature of specific MSR resources: 


a. Each thread initializes its data structure to indicate that it does not own any MC bank registers. 
b. Each thread examines IA32_MCi_CTL2[30] indicator for each bank to determine if another thread has 
already claimed ownership of that bank. 


¢ If IA32_MCi_CTL2[30] had been set by another thread. This thread can not own bank / and should 
proceed to step b. and examine the next machine check bank until all of the machine check banks are 
exhausted. 


¢ If IA32_MCi_CTL2[30] = 0, proceed to step c. 
c. Check whether writing a 1 into IA32_MCi_CTL2[30] can return with 1 on a subsequent read to determine 
this bank can support CMCI. 


¢ If IA32_MCi_CTL2[30] = 0, this bank does not support CMCI. This thread can not own bank / and should 
proceed to step b. and examine the next machine check bank until all of the machine check banks are 
exhausted. 


¢ = If IA32_MCi_CTL2[30] = 1, modify the per-thread data structure to indicate this thread claims 
ownership to the MC bank; proceed to initialize the error threshold count (bits 15:0) of that bank as 
described in Chapter 16, “CMCI Threshold Management”. Then proceed to step b. and examine the next 
machine check bank until all of the machine check banks are exhausted. 


e  =©After the thread has examined all of the machine check banks, it sees if it owns any MC banks to service CMCI. 
If any bank has been claimed by this thread: 


— Ensure that the CMCI interrupt handler has been set up as described in Chapter 16, “CMCI Interrupt 
Handler”. 


— Initialize the CMCI LVT entry, as described in Section 16.5.1, “CMCI Local APIC Interface.” 


— Log and clear all of IA32_MCi_Status registers for the banks that this thread owns. This will allow new 
errors to be logged. 
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16.5.2.2 CMCI Threshold Management 


The Corrected MC error threshold field, IA32_MCi_CTL2[14:0], is architecturally defined. Specifically, all these bits 

are writable by software, but different processor implementations may choose to implement less than 15 bits as 

threshold for the overflow comparison with IA32_MCi_STATUS[52:38]. The following describes techniques that 

software can manage CMCI threshold to be compatible with changes in implementation characteristics: 

¢ Software can set the initial threshold value to 1 by writing 1 to IA32_MCi_CTL2[14:0]. This will cause overflow 
condition on every corrected MC error and generates a CMCI interrupt. 


* To increase the threshold and reduce the frequency of CMCI servicing: 
a. Find the maximum threshold value a given processor implementation supports. The steps are: 
* Write 7FFFH to IA32_MCi_CTL2[14:0], 


¢ Read back IA32_MCi_CTL2[14:0]; these 15 bits (14:0) contain the maximum threshold supported by 
the processor. 


b. Increase the threshold to a value below the maximum value discovered using step a. 


16.5.2.3. CMCI Interrupt Handler 
The following describes techniques system software may consider to implement a CMCI service routine: 


¢ The service routine examines its private per-thread data structure to check which set of MC banks it has 
ownership. If the thread does not have ownership of a given MC bank, proceed to the next MC bank. Ownership 
is determined at initialization time which is described in Section 16.5.2.1. 


If the thread had claimed ownership to an MC bank, this technique will allow each logical processors to handle 
corrected MC errors independently and requires no synchronization to access shared MSR resources. Consult 
Example 16-5 for guidelines on logging when processing CMCI. 


16.6 RECOVERY OF UNCORRECTED RECOVERABLE (UCR) ERRORS 


Recovery of uncorrected recoverable machine check errors is an enhancement in machine-check architecture. The 
first processor that supports this feature is 45 nm Intel 64 processor on which CPUID reports DisplayFamily_Dis- 
playModel as 06H_2EH; see the CPUID instruction in Chapter 3, “Instruction Set Reference, A-L,” in the Intel® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 2A. This allows system software to perform recovery 
action on a certain class of uncorrected errors and continue execution. 


16.6.1 Detection of Software Error Recovery Support 


Software must use bit 24 of IA32_MCG_CAP (MCG_SER_P) to detect the presence of software error recovery 
support (see Figure 16-2). When IA32_MCG_CAP[24] is set, this indicates that the processor supports software 
error recovery. When this bit is clear, this indicates that there is no support for error recovery from the processor 
and the primary responsibility of the machine check handler is logging the machine check error information and 
shutting down the system. 


The new class of architectural MCA errors from which system software can attempt recovery is called Uncorrected 
Recoverable (UCR) Errors. UCR errors are uncorrected errors that have been detected and signaled but have not 
corrupted the processor context. For certain UCR errors, this means that once system software has performed a 
certain recovery action, it is possible to continue execution on this processor. UCR error reporting provides an error 
containment mechanism for data poisoning. The machine check handler will use the error log information from the 
error reporting registers to analyze and implement specific error recovery actions for UCR errors. 


16.6.2 | UCR Error Reporting and Logging 


IA32_MCi_STATUS MSR is used for reporting UCR errors and existing corrected or uncorrected errors. The defini- 
tions of IA32_MCi_STATUS, including bit fields to identify UCR errors, is shown in Figure 16-6. UCR errors can be 
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signaled through either the corrected machine check interrupt (CMCI) or machine check exception (MCE) path 
depending on the type of the UCR error. 


When IA32_MCG_CAP[24] is set, a UCR error is indicated by the following bit settings in the IA32_MCi_STATUS 
register: 


* Valid (bit 63) = 1 
* UC (bit 61) = 1 
* PCC (bit 57) = 0 


Additional information from the IA32_MCi_MISC and the IA32_MCi_ADDR registers for the UCR error are available 
when the ADDRV and the MISCV flags in the IA32_MCi_STATUS register are set (see Section 16.3.2.4). The MCA 
error code field of the IA32_MCi_STATUS register indicates the type of UCR error. System software can interpret 
the MCA error code field to analyze and identify the necessary recovery action for the given UCR error. 


In addition, the IA32_MCi_STATUS register bit fields, bits 56:55, are defined (see Figure 16-6) to provide addi- 
tional information to help system software to properly identify the necessary recovery action for the UCR error: 


° S (Signaling) flag, bit 56 - Indicates (when set) that a machine check exception was generated for the UCR 
error reported in this MC bank and system software needs to check the AR flag and the MCA error code fields in 
the IA32_MCi_STATUS register to identify the necessary recovery action for this error. When the S flag in the 
IA32_MCi_STATUS register is clear, this UCR error was not signaled via a machine check exception and instead 
was reported as a corrected machine check (CMC). System software is not required to take any recovery action 
when the S flag in the IA32_MCi_STATUS register is clear. 


e AR (Action Required) flag, bit 55 - Indicates (when set) that MCA error code specific recovery action must be 
performed by system software at the time this error was signaled. This recovery action must be completed 
successfully before any additional work is scheduled for this processor. When the RIPV flag in the IA32_MC- 
G_STATUS is clear, an alternative execution stream needs to be provided; when the MCA error code specific 
recovery specific recovery action cannot be successfully completed, system software must shut down the 
system. When the AR flag in the IA32_MCi_STATUS register is clear, system software may still take MCA error 
code specific recovery action but this is optional; system software can safely resume program execution at the 
instruction pointer saved on the stack from the machine check exception when the RIPV flag in the IA32_MC- 
G_STATUS register is set. 


Both the S and the AR flags in the IA32_MCi_STATUS register are defined to be sticky bits, which mean that once 
set, the processor does not clear them. Only software and good power-on reset can clear the S and the AR-flags. 
Both the S and the AR flags are only set when the processor reports the UCR errors (MCG_CAP[24] is set). 


16.6.3. UCR Error Classification 
With the S and AR flag encoding in the IA32_MCi_STATUS register, UCR errors can be classified as: 


¢ Uncorrected no action required (UCNA) - is a UCR error that is not signaled via a machine check exception and, 
instead, is reported to system software as a corrected machine check error. UCNA errors indicate that some 
data in the system is corrupted, but the data has not been consumed and the processor state is valid and you 
may continue execution on this processor. UCNA errors require no action from system software to continue 
execution. A UCNA error is indicated with UC=1, PCC=0, S=0 and AR=0 in the IA32_MCi_STATUS register. 


° Software recoverable action optional (SRAO) - a UCR error is signaled either via a machine check exception or 
CMCI. System software recovery action is optional and not required to continue execution from this machine 
check exception. SRAO errors indicate that some data in the system is corrupt, but the data has not been 
consumed and the processor state is valid. SRAO errors provide the additional error information for system 
software to perform a recovery action. An SRAO error when signaled as a machine check is indicated with 
UC=1, PCC=0, S=1, EN=1 and AR=0 in the IA32_MCi_STATUS register. In cases when SRAO is signaled via 
CMCI the error signature is indicated via UC=1, PCC=0, S=0. Recovery actions for SRAO errors are MCA error 
code specific. The MISCV and the ADDRV flags in the IA32_MCi_STATUS register are set when the additional 
error information is available from the IA32_MCi_MISC and the IA32_MCi_ADDR registers. System software 
needs to inspect the MCA error code fields in the IA32_MCi_STATUS register to identify the specific recovery 
action for a given SRAO error. If MISCV and ADDRV are not set, it is recommended that no system software 
error recovery be performed however, system software can resume execution. 


° Software recoverable action required (SRAR) - a UCR error that requires system software to take a recovery 
action on this processor before scheduling another stream of execution on this processor. SRAR errors indicate 
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that the error was detected and raised at the point of the consumption in the execution flow. An SRAR error is 
indicated with UC=1, PCC=0, S=1, EN=1 and AR=1 in the IA32_MCi_STATUS register. Recovery actions are 
MCA error code specific. The MISCV and the ADDRV flags in the IA32_MCi_STATUS register are set when the 
additional error information is available from the IA32_MCi_MISC and the IA32_MCi_ADDR registers. System 
software needs to inspect the MCA error code fields in the IA32_MCi_STATUS register to identify the specific 
recovery action for a given SRAR error. If MISCV and ADDRV are not set, it is recommended that system 
software shutdown the system. 


Table 16-7 summarizes UCR, corrected, and uncorrected errors. 
Table 16-7. MC Error Classifications 


Type of Error’ UC |EN /|PCC |S |AR | Signaling | Software Action Example 
Uncorrected Error (UC) | 1 1 1 xX |X MCE If EN=1, reset the system, else log 
and OK to keep the system running. 
SRAR 1 1 0 1 41 MCE For known MCACOD, take specific Cache to processor load 


recovery action; error. 


For unknown MCACOD, must 
bugcheck. 

If OVER=1, reset system, else take 
specific recovery action. 

SRAO 1 x? 0 x2 10 MCE/CMC | For known MCACOD, take specific Patrol scrub and explicit 
recovery action; writeback poison errors. 
For unknown MCACOD, OK to keep 
the system running. 


UCNA 1 x 0 0 |0 CMC Log the error and Ok to keep the Poison detection error. 
system running. 

Corrected Error (CE) 0 X x xX |X CMC Log the error and no corrective ECC in caches and 
action required. memory. 

NOTES: 


1. SRAR, SRAO and UCNA errors are supported by the processor only when IA32_MCG_CAP[24] (MCG_SER_P) is set. 
2. EN=1, S=1 when signaled via MCE. EN=x, S=O when signaled via CMC. 


16.6.4 UCR Error Overwrite Rules 


In general, the overwrite rules are as follows: 

¢ UCR errors will overwrite corrected errors. 

® Uncorrected (PCC=1) errors overwrite UCR (PCC=0) errors. 
¢ UCR errors are not written over previous UCR errors. 

* Corrected errors do not write over previous UCR errors. 


Regardless of whether the ist error is retained or the 2nd error is overwritten over the 1st error, the OVER flag in 
the IA32_MCi_STATUS register will be set to indicate an overflow condition. As the S flag and AR flag in the 
IA32_MCi_STATUS register are defined to be sticky flags, a second event cannot clear these 2 flags once set, 
however the MC bank information may be filled in for the 2nd error. The table below shows the overwrite rules and 
how to treat a second error if the first event is already logged in a MC bank along with the resulting bit setting of 
the UC, PCC, and AR flags in the IA32_MCi_STATUS register. As UCNA and SRAO errors do not require recovery 
action from system software to continue program execution, a system reset by system software is not required 
unless the AR flag or PCC flag is set for the UCR overflow case (OVER=1, VAL=1, UC=1, PCC=0). 


Table 16-8 lists overwrite rules for uncorrected errors, corrected errors, and uncorrected recoverable errors. 
Table 16-8. Overwrite Rules for UC, CE, and UCR Errors 


First Event Second Event UC PCC |S AR MCA Bank Reset System 
cE UCR 1 0 Oif UCNA, else 1 | 1if SRAR, else O | second yes, if AR=1 
UCR CE 1 0 O if UCNA, else 1 | 1 if SRAR, else O | first yes, if AR=1 
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Table 16-8. Overwrite Rules for UC, CE, and UCR Errors 


First Event Second Event UC PCC |S AR MCA Bank Reset System 
UCNA UCNA 1 0 0 0 first no 
UCNA SRAO 1 0 1 0 first no 
UCNA SRAR 1 0 1 1 first yes 
SRAO UCNA 1 0 1 0 first no 
SRAO SRAO 1 0 1 0 first no 
SRAO SRAR 1 0 1 1 first yes 
SRAR UCNA 1 0 1 1 first yes 
SRAR SRAO 1 0 1 1 first yes 
SRAR SRAR 1 0 1 1 first yes 
UCR UC 1 1 undefined undefined second yes 
UC UCR 1 1 undefined undefined first yes 


16.7  MACHINE-CHECK AVAILABILITY 


The machine-check architecture and machine-check exception (#MC) are model-specific features. Software can 
execute the CPUID instruction to determine whether a processor implements these features. Following the execu- 
tion of the CPUID instruction, the settings of the MCA flag (bit 14) and MCE flag (bit 7) in EDX indicate whether the 
processor implements the machine-check architecture and machine-check exception. 


16.8 MACHINE-CHECK INITIALIZATION 


To use the processors machine-check architecture, software must initialize the processor to activate the machine- 
check exception and the error-reporting mechanism. 


Example 16-1 gives pseudocode for performing this initialization. This pseudocode checks for the existence of the 
machine-check architecture and exception; it then enables machine-check exception and the error-reporting 
register banks. The pseudocode shown is compatible with the Pentium 4, Intel Xeon, Intel Atom, P6 family, and 
Pentium processors. 


Following power up or power cycling, IA32_MCi_STATUS registers are not guaranteed to have valid data until after 
they are initially cleared to zero by software (as shown in the initialization pseudocode in Example 16-1). 


Example 16-1. Machine-Check Initialization Pseudocode 


Check CPUID Feature Flags for MCE and MCA support 
IF CPU supports MCE 
THEN 
IF CPU supports MCA 
THEN 
IF (IA32_MCG_CAP.MCG_CTL_P = 1) 
(* IA32_MCG_CTL register is present *) 
THEN 
IA32_MCG_CTL <— FFFFFFFFFFFFFFFFH; 
(* enables all MCA features *) 


Fl 


IF (IA32_MCG_CAP.MCG_LMCE_P = 1 and IA32_FEATURE_CONTROL.LOCK = 1 and IA32_FEATURE_CONTROL.LMCE_ENABLED = 1) 
(* IA32_MCG_EXT_CTL register is present and platform has enabled LMCE to permit system software to use LMCE *) 
THEN 
IA32_MCG_EXT_CTL < IA32_MCG_EXT_CTL | 01H; 
(* System software enables LMCE capability for hardware to signal MCE to a single logical processor*) 
Fl 
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(* Determine number of error-reporting banks supported *) 
COUNT< 1A32_MCG_CAP.Count; 
MAX_BANK_NUMBER <— COUNT - 1; 


IF (Processor Family is 6H and Processor EXTMODEL:MODEL is less than 1AH) 
THEN 
(* Enable logging of all errors except for MCO_CTL register *) 
FOR error-reporting banks (1 through MAX_BANK_NUMBER) 
DO 
IA32_MCi_CTL < OFFFFFFFFFFFFFFFFH; 
OD 


ELSE 
(* Enable logging of all errors including MCO_CTL register *) 
FOR error-reporting banks (0 through MAX_BANK_NUMBER) 
DO 
IA32_MCi_CTL < OFFFFFFFFFFFFFFFFH; 
OD 
Fl 


(* BIOS clears all errors only on power-on reset *) 
IF (BIOS detects Power-on reset) 
THEN 
FOR error-reporting banks (0 through MAX_BANK_NUMBER) 
DO 
IA32_MCi_STATUS < 0; 
OD 
ELSE 
FOR error-reporting banks (0 through MAX_BANK_NUMBER) 
DO 
(Optional for BIOS and OS) Log valid errors 
(OS only) IA32_MCi_STATUS < 0; 
OD 


Fl 
Fl 


Setup the Machine Check Exception (HMC) handler for vector 18 in IDT 


Set the MCE bit (bit 6) in CR4 register to enable Machine-Check Exceptions 
Fl 


16.9 INTERPRETING THE MCA ERROR CODES 


When the processor detects a machine-check error condition, it writes a 16-bit error code to the MCA error code 
field of one of the IA32_MCi_STATUS registers and sets the VAL (valid) flag in that register. The processor may also 
write a 16-bit model-specific error code in the IA32_MCi_STATUS register depending on the implementation of the 
machine-check architecture of the processor. 


The MCA error codes are architecturally defined for Intel 64 and IA-32 processors. To determine the cause of a 
machine-check exception, the machine-check exception handler must read the VAL flag for each IA32_M- 
Ci_STATUS register. If the flag is set, the machine check-exception handler must then read the MCA error code field 
of the register. It is the encoding of the MCA error code field [15:0] that determines the type of error being reported 
and not the register bank reporting it. 


There are two types of MCA error codes: simple error codes and compound error codes. 


16.9.1. Simple Error Codes 


Table 16-9 shows the simple error codes. These unique codes indicate global error information. 
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Table 16-9. IA32_MCi_Status [15:0] Simple Error Code Encoding 


Error Code Binary Encoding Meaning 

No Error 0000 0000 0000 0000 No error has been reported to this bank of error-reporting 
registers. 

Unclassified 0000 0000 0000 0001 This error has not been classified into the MCA error classes. 

Microcode ROM Parity Error 0000 0000 0000 0010 Parity error in internal microcode ROM 

External Error 0000 0000 0000 0011 The BINIT# from another processor caused this processor to 
enter machine check.' 

FRC Error 0000 0000 0000 0100 FRC (functional redundancy check) main/secondary error. 

Internal Parity Error 0000 0000 0000 0101 Internal parity error. 

SMM Handler Code Access 0000 0000 0000 0110 An attempt was made by the SMM Handler to execute 

Violation outside the ranges specified by SMRR. 

Internal Timer Error 0000 0100 0000 0000 Internal timer error. 


I/O Error 0000 1110 0000 1011 generic I/O error. 
Internal Unclassified OO00 01xx XXXxx XXXX Internal unclassified errors. © 
NOTES: 


1. BINIT# assertion will cause a machine check exception if the processor (or any processor on the same external bus) has BINIT# 
observation enabled during power-on configuration (hardware strapping) and if machine check exceptions are enabled (by setting 


CR4.MCE = 1). 


2. At least one X must equal one. Internal unclassified errors have not been classified. 


16.9.2 


Compound Error Codes 


Compound error codes describe errors related to the TLBs, memory, caches, bus and interconnect logic, and 
internal timer. A set of sub-fields is common to all of compound errors. These sub-fields describe the type of 
access, level in the cache hierarchy, and type of request. Table 16-10 shows the general form of the compound 


error codes. 


Table 16-10. IA32_MCi_Status [15:0] Compound Error Code Encoding 


Type 
Generic Cache Hierarchy 


Form 
OOOF 0000 0000 11LL 


Interpretation 
Generic cache hierarchy error 


TLB Errors 


OOOF 0000 0001 TTLL 


{TT}TLB{LL}_ERR 


Memory Controller Errors 


OOOF 0000 1MMM CCCC 


{MMM}_CHANNEL{CCCC}_ERR 


Cache Hierarchy Errors 


OOOF 0001 RRRR TTLL 


{TT}CACHE{LL} {RRRR}_ERR 


Extended Memory Errors 


OOOF 0010 1MMM CCCC 


{MMM}_CHANNEL{CCCC}_ERR 


Bus and Interconnect Errors 


OOOF 1PPT RRRR IILL 


BUS{LU_{PP}_{RRRR}_{Il]_{T}_ERR 


The “Interpretation” column in the table indicates the name of a compound error. The name is constructed by 
substituting mnemonics for the sub-field names given within curly braces. For example, the error code 
ICACHEL1_RD_ERR is constructed from the form: 


{TT}CACHE{LL}_{RRRR}_ERR, 


where {TT} is replaced by |, {LL} is replaced by L1, and {RRRR} is replaced by RD. 


For more information on the “Form” and “Interpretation” columns, see Section 16.9.2.1, “Correction Report 
Filtering (F) Bit,” through Section 16.9.2.5, “Bus and Interconnect Errors.” 


16.9.2.1 


Correction Report Filtering (F) Bit 


Starting with Intel Core Duo processors, bit 12 in the “Form” column in Table 16-10 is used to indicate that a partic- 
ular posting to a log may be the last posting for corrections in that line/entry, at least for some time: 
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* Qin bit 12 indicates “normal” filtering (original P6/Pentium4/Atom/Xeon processor meaning). 


® = 1in bit 12 indicates “corrected” filtering (filtering is activated for the line/entry in the posting). Filtering means 
that some or all of the subsequent corrections to this entry (in this structure) will not be posted. The enhanced 
error reporting introduced with the Intel Core Duo processors is based on tracking the lines affected by 
repeated corrections (see Section 16.4, “Enhanced Cache Error reporting”). This capability is indicated by 
IA32_MCG_CAP[11]. Only the first few correction events for a line are posted; subsequent redundant 
correction events to the same line are not posted. Uncorrected events are always posted. 


The behavior of error filtering after crossing the yellow threshold is model-specific. Filtering has meaning only for 
corrected errors (UC=0 in IA32_MCi_STATUS MSR). System software must ignore filtering bit (12) for uncorrected 


errors. 


16.9.2.2 Transaction Type (TT) Sub-Field 

The 2-bit TT sub-field (Table 16-11) indicates the type of transaction (data, instruction, or generic). The sub-field 
applies to the TLB, cache, and interconnect error conditions. Note that interconnect error conditions are primarily 
associated with P6 family and Pentium processors, which utilize an external APIC bus separate from the system 
bus. The generic type is reported when the processor cannot determine the transaction type. 


Table 16-11. Encoding for TT (Transaction Type) Sub-Field 


Transaction Type Mnemonic Binary Encoding 
Instruction | 00 
Data D 01 
Generic G 10 


16.9.2.3 Level (LL) Sub-Field 

The 2-bit LL sub-field (see Table 16-12) indicates the level in the memory hierarchy where the error occurred (level 
0, level 1, level 2, or generic). The LL sub-field also applies to the TLB, cache, and interconnect error conditions. 
The Pentium 4, Intel Xeon, Intel Atom, and P6 family processors support two levels in the cache hierarchy and one 
level in the TLBs. Again, the generic type is reported when the processor cannot determine the hierarchy level. 


Table 16-12. Level Encoding for LL (Memory Hierarchy Level) Sub-Field 


Hierarchy Level Mnemonic Binary Encoding 
Level 0 LO 00 
Level 1 1 01 
Level 2 L2 10 
Generic LG 11 


16.9.2.4 Request (RRRR) Sub-Field 

The 4-bit RRRR sub-field (see Table 16-13) indicates the type of action associated with the error. Actions include 
read and write operations, prefetches, cache evictions, and snoops. Generic error is returned when the type of 
error cannot be determined. Generic read and generic write are returned when the processor cannot determine the 
type of instruction or data request that caused the error. Eviction and snoop requests apply only to the caches. All 
of the other requests apply to TLBs, caches, and interconnects. 
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Table 16-13. Encoding of Request (RRRR) Sub-Field 


Request Type Mnemonic Binary Encoding 
Generic Error ERR 0000 
Generic Read RD 0001 
Generic Write WR 0010 
Data Read DRD 0011 
Data Write DWR 0100 
Instruction Fetch IRD 0101 
Prefetch PREFETCH 0110 
Eviction EVICT 0111 
Snoop SNOOP 1000 


16.9.2.5 Bus and Interconnect Errors 


The bus and interconnect errors are defined with the 2-bit PP (participation), 1-bit T (time-out), and 2-bit II 
(memory or I/O) sub-fields, in addition to the LL and RRRR sub-fields (see Table 16-14). The bus error conditions 
are implementation dependent and related to the type of bus implemented by the processor. Likewise, the inter- 
connect error conditions are predicated on a specific implementation-dependent interconnect model that describes 
the connections between the different levels of the storage hierarchy. The type of bus is implementation depen- 
dent, and as such is not specified in this document. A bus or interconnect transaction consists of a request involving 
an address and a response. 


Table 16-14. Encodings of PP, T, and II Sub-Fields 


Sub-Field Transaction Mnemonic Binary Encoding 
PP (Participation) Local processor* originated request SRC 00 
Local processor* responded to request RES 01 
Local processor* observed error as third party OBS 10 
Generic 11 
T (Time-out) Request timed out TIMEOUT 1 
Request did not time out NOTIMEOUT 0 
Il (Memory or I/O) Memory Access M 00 
Reserved 01 
1/0 10 10 
Other transaction 11 


NOTE: 


* Local processor differentiates the processor reporting the error from other system components (including the APIC, other proces- 


sors, etc.). 
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16.9.2.6 Memory Controller and Extended Memory Errors 


The memory controller errors are defined with the 3-bit MMM (memory transaction type), and 4-bit CCCC (channel) 
sub-fields. The encodings for MMM and CCCC are defined in Table 16-15. Extended Memory errors use the same 
encodings and are used to report errors in memory used as a cache. 


Table 16-15. Encodings of MMM and CCCC Sub-Fields 


Sub-Field Transaction Mnemonic Binary Encoding 
MMM Generic undefined request GEN 000 
Memory read error RD 001 
Memory write error WR 010 
Address/Command Error AC 011 
Memory Scrubbing Error MS 100 
Reserved 101-111 
Cccc Channel number CHN 0000-1110 
Channel not specified 1111 


Note that the CCCC channel number may be enumerated from zero separately by each memory controller on a 
system. On a multi-socket system, or a system with multiple memory controllers per socket, it is necessary to also 
consider which machine check bank logged the error. See Chapter 17 for details on specific implementations. 


16.9.3 Architecturally Defined UCR Errors 


Software recoverable compound error code are defined in this section. 


16.9.3.1 Architecturally Defined SRAO Errors 

The following two SRAO errors are architecturally defined. 

e UCR Errors detected by memory controller scrubbing; and 

¢ UCR Errors detected during L3 cache (L3) explicit writebacks. 


The MCA error code encodings for these two architecturally-defined UCR errors corresponds to sub-classes of 
compound MCA error codes (see Table 16-10). Their values and compound encoding format are given in Table 
16-16. 


Table 16-16. MCA Compound Error Code Encoding for SRAO Errors 


Type MCACOD Value | MCA Error Code Encoding! 


Memory Scrubbing | COH - CFH 0000_0000_1100_CCCC 

OOOF 0000 1MMM CCCC (Memory Controller Error), where 
Memory subfield MMM = 100B (memory scrubbing) 
Channel subfield CCCC = channel # or generic 


L3 Explicit Writeback | 17AH 0000_0001_0111_1010 

OOOF 0001 RRRR TTLL (Cache Hierarchy Error) where 
Request subfields RRRR = 0111B (Eviction) 
Transaction Type subfields TT = 10B (Generic) 

Level subfields LL = 10B 


NOTES: 
1. Note that for both of these errors the correction report filtering (F) bit (bit 12) of the MCA error must be ignored. 
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Table 16-17 lists values of relevant bit fields of IA32_MCi_STATUS for architecturally defined SRAO errors. 
Table 16-17. IA32_MCi_STATUS Values for SRAO Errors 


SRAO Error Valid OVER uc [EN |MISCV ADDRV Pcc |S JAR |MCACOD 
Memory Scrubbing 1 0 1 x | 1 0 x' 10 | COH-CFH 
L3 Explicit Writeback 1 ft) 1 x? 14 1 0 x’ [0 17AH 


NOTES: 
1. When signaled as MCE, EN=1 and S=1. If error was signaled via CMC, then EN=x, and S=0. 


For both the memory scrubbing and L3 explicit writeback errors, the ADDRV and MISCV flags in the IA32_M- 
Ci_STATUS register are set to indicate that the offending physical address information is available from the 
IA32_MCi_MISC and the IA32_MCi_ADDR registers. For the memory scrubbing and L3 explicit writeback errors, 
the address mode in the IA32_MCi_MISC register should be set as physical address mode (010b) and the address 
LSB information in the IA32_MCi_MISC register should indicate the lowest valid address bit in the address informa- 
tion provided from the IA32_MCi_ADDR register. 

MCE signal is broadcast to all logical processors as outlined in Section 16.10.4.1. If LMCE is supported and enabled, 
some errors (not limited to UCR errors) may be delivered to only a single logical processor. System software should 
consult IA32_MCG_STATUS.LMCE_S to determine if the MCE signaled is only to this logical processor. 
IA32_MCi_STATUS banks can be shared by logical processors within a core or within the same package. So several 
logical processors may find an SRAO error in the shared IA32_MCi_STATUS bank but other processors do not find 
it in any of the IA32_MCi_STATUS banks. Table 16-18 shows the RIPV and EIPV flag indication in the IA32_MC- 
G_STATUS register for the memory scrubbing and L3 explicit writeback errors on both the reporting and non- 
reporting logical processors. 


Table 16-18. IA32_MCG_STATUS Flag Indication for SRAO Errors 


SRAO Type Reporting Logical Processors Non-reporting Logical Processors 
RIPV EIPV RIPV EIPV 

Memory Scrubbing 1 0 1 0 

L3 Explicit Writeback 1 6) 1 0 


16.9.3.2 Architecturally Defined SRAR Errors 

The following two SRAR errors are architecturally defined. 
¢ UCR Errors detected on data load; and 

¢ UCR Errors detected on instruction fetch. 


The MCA error code encodings for these two architecturally-defined UCR errors corresponds to sub-classes of 
compound MCA error codes (see Table 16-10). Their values and compound encoding format are given in Table 
16-19. 


Table 16-19. MCA Compound Error Code Encoding for SRAR Errors 
MCACOD Value | MCA Error Code Encoding’ 
134H 0000_0001_0011_0100 
OOOF 0001 RRRR TTLL (Cache Hierarchy Error), where 
Request subfield RRRR = 0011B (Data Load) 
Transaction Type subfield TT= 01B (Data) 
Level subfield LL = OOB (Level 0) 
0000_0001_0101_0000 
OOOF 0001 RRRR TTLL (Cache Hierarchy Error), where 
Request subfield RRRR = 0101B (Instruction Fetch) 
Transaction Type subfield TT= OOB (Instruction) 
Level subfield LL = OOB (Level 0) 


Type 
Data Load 


Instruction Fetch 150H 
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NOTES: 
1. Note that for both of these errors the correction report filtering (F) bit (bit 12) of the MCA error must be ignored. 


Table 16-20 lists values of relevant bit fields of IA32_MCi_STATUS for architecturally defined SRAR errors. 
Table 16-20. [A32_MCi_STATUS Values for SRAR Errors 


SRAR Error Valid OVER UC |EN_ |MISCV ADDRV PCC S |AR- |MCACOD 
Data Load 1 0 1 1 1 1 0 1 1 134H 
Instruction Fetch 1 0 1 1 1 1 0 1 1 150H 


For both the data load and instruction fetch errors, the ADDRV and MISCV flags in the IA32_MCi_STATUS register 
are set to indicate that the offending physical address information is available from the IA32_MCi_MISC and the 
IA32_MCi_ADDR registers. For the data load and instruction fetch errors, the address mode in the IA32_MCi_MISC 
register should be set as physical address mode (010b) and the address LSB information in the IA32_MCi_MISC 
register should indicate the lowest valid address bit in the address information provided from the IA32_MCi_ADDR 
register. 

MCE signal is broadcast to all logical processors on the system on which the UCR errors are supported, except when 
the processor supports LMCE and LMCE is enabled by system software (see Section 16.3.1.5). The IA32_MC- 
G_STATUS MSR allows system software to distinguish the affected logical processor of an SRAR error amongst 
logical processors that observed SRAR via MCi_STATUS bank. 


Table 16-21 shows the RIPV and EIPV flag indication in the IA32_MCG_STATUS register for the data load and 
instruction fetch errors on both the reporting and non-reporting logical processors. The recoverable SRAR error 
reported by a processor may be continuable, where the system software can interpret the context of continuable 
as follows: the error was isolated, contained. If software can rectify the error condition in the current instruction 
stream, the execution context on that logical processor can be continued without loss of information. 


Table 16-21. IA32_MCG_STATUS Flag Indication for SRAR Errors 


SRAR Type Affected Logical Processor Non-Affected Logical Processors 

RIPV EIPV Continuable RIPV EIPV Continuable 
Recoverable- 1 1 Yes! 
continuable 
Recoverable-not- 0 x No 1 0 Yes 
continuable 
NOTES: 


1. see the definition of the context of “continuable” above and additional detail below. 


SRAR Error And Affected Logical Processors 

The affected logical processor is the one that has detected and raised an SRAR error at the point of the consump- 
tion in the execution flow. The affected logical processor should find the Data Load or the Instruction Fetch error 
information in the IA32_MCi_STATUS register that is reporting the SRAR error. 


Table 16-21 list the actionable scenarios that system software can respond to an SRAR error on an affected logical 

processor according to RIPV and EIPV values: 

¢ Recoverable-Continuable SRAR Error (RIPV=1, EIPV=1): 
For Recoverable-Continuable SRAR errors, the affected logical processor should find that both the IA32_MC- 
G_STATUS.RIPV and the IA32_MCG_STATUS.EIPV flags are set, indicating that system software may be able to 
restart execution from the interrupted context if it is able to rectify the error condition. If system software 
cannot rectify the error condition then it must treat the error as a recoverable error where restarting execution 
with the interrupted context is not possible. Restarting without rectifying the error condition will result in most 
cases with another SRAR error on the same instruction. 
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¢ Recoverable-not-continuable SRAR Error (RIPV=0, EIPV=x): 
For Recoverable-not-continuable errors, the affected logical processor should find that either 
— JA32_MCG_STATUS.RIPV= 0, IA32_MCG_STATUS.EIPV=1, or 
— JIA32_MCG_STATUS.RIPV= 0, IA32_MCG_STATUS.EIPV=0. 


In either case, this indicates that the error is detected at the instruction pointer saved on the stack for this 
machine check exception and restarting execution with the interrupted context is not possible. System 
software may take the following recovery actions for the affected logical processor: 


¢ The current executing thread cannot be continued. System software must terminate the interrupted 
stream of execution and provide a new stream of execution on return from the machine check handler 
for the affected logical processor. 


SRAR Error And Non-Affected Logical Processors 


The logical processors that observed but not affected by an SRAR error should find that the RIPV flag in the 
IA32_MCG_STATUS register is set and the EIPV flag in the IA32_MCG_STATUS register is cleared, indicating that it 
is safe to restart the execution at the instruction saved on the stack for the machine check exception on these 
processors after the recovery action is successfully taken by system software. 


16.9.4 Multiple MCA Errors 


When multiple MCA errors are detected within a certain detection window, the processor may aggregate the 
reporting of these errors together as a single event, i.e., a single machine exception condition. If this occurs, 
system software may find multiple MCA errors logged in different MC banks on one logical processor or find 
multiple MCA errors logged across different processors for a single machine check broadcast event. In order to 
handle multiple UCR errors reported from a single machine check event and possibly recover from multiple errors, 
system software may consider the following: 


¢ Whether it can recover from multiple errors is determined by the most severe error reported on the system. If 
the most severe error is found to be an unrecoverable error (VAL=1, UC=1, PCC=1 and EN=1) after system 
software examines the MC banks of all processors to which the MCA signal is broadcast, recovery from the 
multiple errors is not possible and system software needs to reset the system. 


¢ When multiple recoverable errors are reported and no other fatal condition (e.g., overflowed condition for SRAR 
error) is found for the reported recoverable errors, it is possible for system software to recover from the 
multiple recoverable errors by taking necessary recovery action for each individual recoverable error. However, 
system software can no longer expect one to one relationship with the error information recorded in the 
IA32_MCi_STATUS register and the states of the RIPV and EIPV flags in the IA32_MCG_STATUS register as the 
states of the RIPV and the EIPV flags in the IA32_MCG_STATUS register may indicate the information for the 
most severe error recorded on the processor. System software is required to use the RIPV flag indication in the 
IA32_MCG_STATUS register to make a final decision of recoverability of the errors and find the restart-ability 
requirement after examining each IA32_MCi_STATUS register error information in the MC banks. 


In certain cases where system software observes more than one SRAR error logged for a single logical 
processor, it can no longer rely on affected threads as specified in Table 15-20 above. System software is 
recommended to reset the system if this condition is observed. 


16.9.5 Machine-Check Error Codes Interpretation 


Chapter 17, “Interpreting Machine Check Error Codes,” provides information on interpreting the MCA error code, 
model-specific error code, and other information error code fields. For P6 family processors, information has been 
included on decoding external bus errors. For Pentium 4 and Intel Xeon processors; information is included on 
external bus, internal timer and cache hierarchy errors. 
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16.10 GUIDELINES FOR WRITING MACHINE-CHECK SOFTWARE 


The machine-check architecture and error logging can be used in three different ways: 
¢ To detect machine errors during normal instruction execution, using the machine-check exception (#MC). 
¢ To periodically check and log machine errors. 


° To examine recoverable UCR errors, determine software recoverability and perform recovery actions via a 
machine-check exception handler or a corrected machine-check interrupt handler. 


To use the machine-check exception, the operating system or executive software must provide a machine-check 
exception handler. This handler may need to be designed specifically for each family of processors. 


A special program or utility is required to log machine errors. 


Guidelines for writing a machine-check exception handler or a machine-error logging utility are given in the 
following sections. 


16.10.1 Machine-Check Exception Handler 


The machine-check exception (#MC) corresponds to vector 18. To service machine-check exceptions, a trap gate 
must be added to the IDT. The pointer in the trap gate must point to a machine-check exception handler. Two 
approaches can be taken to designing the exception handler: 


1. The handler can merely log all the machine status and error information, then call a debugger or shut down the 
system. 


2. The handler can analyze the reported error information and, in some cases, attempt to correct the error and 
restart the processor. 


For Pentium 4, Intel Xeon, Intel Atom, P6 family, and Pentium processors; virtually all machine-check conditions 
cannot be corrected (they result in abort-type exceptions). The logging of status and error information is therefore 
a baseline implementation requirement. 


When IA32_MCG_CAP[24] is clear, consider the following when writing a machine-check exception handler: 


* To determine the nature of the error, the handler must read each of the error-reporting register banks. The 
count field in the IA32_MCG_CAP register gives number of register banks. The first register of register bank 0 
is at address 400H. 


¢ The VAL (valid) flag in each IA32_MCi_STATUS register indicates whether the error information in the register 
is valid. If this flag is clear, the registers in that bank do not contain valid error information and do not need to 
be checked. 


° To write a portable exception handler, only the MCA error code field in the IA32_MCi_STATUS register should be 
checked. See Section 16.9, “Interpreting the MCA Error Codes,” for information that can be used to write an 
algorithm to interpret this field. 


* Correctable errors are corrected automatically by the processor. The UC flag in each IA32_MCi_STATUS reg- 
ister indicates whether the processor automatically corrected an error. 


° The RIPV, PCC, and OVER flags in each IA32_MCi_STATUS register indicate whether recovery from the error is 
possible. If PCC or OVER are set, recovery is not possible. If RIPV is not set, program execution can not be 
restarted reliably. When recovery is not possible, the handler typically records the error information and signals 
an abort to the operating system. 


¢ The RIPV flag in the IA32_MCG_STATUS register indicates whether the program can be restarted at the 
instruction indicated by the instruction pointer (the address of the instruction pushed on the stack when the 
exception was generated). If this flag is clear, the processor may still be able to be restarted (for debugging 
purposes) but not without loss of program continuity. 


° For unrecoverable errors, the EIPV flag in the IA32_MCG_STATUS register indicates whether the instruction 
indicated by the instruction pointer pushed on the stack (when the exception was generated) is related to the 
error. If the flag is clear, the pushed instruction may not be related to the error. 


¢ The MCIP flag in the IA32_MCG_STATUS register indicates whether a machine-check exception was generated. 
Before returning from the machine-check exception handler, software should clear this flag so that it can be 
used reliably by an error logging utility. The MCIP flag also detects recursion. The machine-check architecture 
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does not support recursion. When the processor detects machine-check recursion, it enters the shutdown 
state. 


Example 16-2 gives typical steps carried out by a machine-check exception handler. 


Example 16-2. Machine-Check Exception Handler Pseudocode 


IF CPU supports MCE 
THEN 
IF CPU supports MCA 
THEN 
call errorlogging routine; (* returns restartability *) 
Fi; 
ELSE (* Pentium(R) processor compatible *) 
READ P5_MC_ADDR 
READ P5_MC_TYPE; 
report RESTARTABILITY to console; 
FI; 
IF error is not restartable 
THEN 
report RESTARTABILITY to console; 
abort system; 
Fi; 
CLEAR MCIP flag in |A32_MCG_STATUS; 


16.10.2 Pentium Processor Machine-Check Exception Handling 


Machine-check exception handler on P6 family, Intel Atom and later processor families, should follow the guidelines 
described in Section 16.10.1 and Example 16-2 that check the processor’s support of MCA. 


NOTE 


On processors that support MCA (CPUID.1.EDX.MCA = 1) reading the P5_MC_TYPE and 
P5_MC_ADDR registers may produce invalid data. 


When machine-check exceptions are enabled for the Pentium processor (MCE flag is set in control register CR4), 
the machine-check exception handler uses the RDMSR instruction to read the error type from the P5_MC_TYPE 
register and the machine check address from the P5_MC_ADDR register. The handler then normally reports these 
register values to the system console before aborting execution (See Example 16-2). 


16.10.3 Logging Correctable Machine-Check Errors 


The error handling routine for servicing the machine-check exceptions is responsible for logging uncorrected 
errors. 


If a machine-check error is correctable, the processor does not generate a machine-check exception for it. To 
detect correctable machine-check errors, a utility program must be written that reads each of the machine-check 
error-reporting register banks and logs the results in an accounting file or data structure. This utility can be imple- 
mented in either of the following ways. 


¢ Asystem daemon that polls the register banks on an infrequent basis, such as hourly or daily. 


° Auser-initiated application that polls the register banks and records the exceptions. Here, the actual polling 
service is provided by an operating-system driver or through the system call interface. 


¢ An interrupt service routine servicing CMCI can read the MC banks and log the error. Please refer to Section 
16.10.4.2 for guidelines on logging correctable machine checks. 


Example 16-3 gives pseudocode for an error logging utility. 
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Example 16-3. Machine-Check Error Logging Pseudocode 


Assume that execution is restartable; 
IF the processor supports MCA 
THEN 
FOR each bank of machine-check registers 
DO 
READ IA32_MCi_STATUS; 
IF VAL flag in IA32_MCi_STATUS = 1 
THEN 
IF ADDRV flag in IA32_MCi_STATUS = 1 
THEN READ IA32_MCi_ADDR; 
FI; 
IF MISCV flag in IA32_MCi_STATUS = 1 
THEN READ IA32_MCi_MISC; 
Fl; 
IF MCIP flag in |A32_MCG_STATUS = 1 
(* Machine-check exception is in progress *) 
AND PCC flag in IA32_MCi_STATUS = 1 
OR RIPV flag in IA32_MCG_STATUS = 0 
(* execution is not restartable *) 
THEN 
RESTARTABILITY = FALSE; 
return RESTARTABILITY to calling procedure; 
FI; 
Save time-stamp counter and processor ID; 
Set [A32_MCi_STATUS to all Os; 
Execute serializing instruction (i.e., CPUID); 
FI; 
OD; 
Fl; 
If the processor supports the machine-check architecture, the utility reads through the banks of error-reporting 
registers looking for valid register entries. It then saves the values of the IA32_MCi_STATUS, IA32_MCi_ADDR, 
IA32_MCi_MISC, and IA32_MCG_STATUS registers for each bank that is valid. The routine minimizes processing 
time by recording the raw data into a system data structure or file, reducing the overhead associated with polling. 
User utilities analyze the collected data in an off-line environment. 


When the MCIP flag is set in the IA32_MCG_STATUS register, a machine-check exception is in progress and the 
machine-check exception handler has called the exception logging routine. 


Once the logging process has been completed the exception-handling routine must determine whether execution 
can be restarted, which is usually possible when damage has not occurred (The PCC flag is clear, in the IA32_M- 
Ci_STATUS register) and when the processor can guarantee that execution is restartable (the RIPV flag is set in the 
IA32_MCG_STATUS register). If execution cannot be restarted, the system is not recoverable and the exception- 
handling routine should signal the console appropriately before returning the error status to the Operating System 
kernel for subsequent shutdown. 


The machine-check architecture allows buffering of exceptions from a given error-reporting bank although the 
Pentium 4, Intel Xeon, Intel Atom, and P6 family processors do not implement this feature. The error logging 
routine should provide compatibility with future processors by reading each hardware error-reporting bank's 
IA32_MCi_STATUS register and then writing Os to clear the OVER and VAL flags in this register. The error logging 
utility should re-read the IA32_MC/_STATUS register for the bank ensuring that the valid bit is clear. The processor 
will write the next error into the register bank and set the VAL flags. 


Additional information that should be stored by the exception-logging routine includes the processor’s time-stamp 
counter value, which provides a mechanism to indicate the frequency of exceptions. A multiprocessing operating 
system stores the identity of the processor node incurring the exception using a unique identifier, such as the 
processor’s APIC ID (see Section 11.8, “Handling Interrupts”). 


The basic algorithm given in Example 16-3 can be modified to provide more robust recovery techniques. For 
example, software has the flexibility to attempt recovery using information unavailable to the hardware. Specifi- 
cally, the machine-check exception handler can, after logging carefully analyze the error-reporting registers when 
the error-logging routine reports an error that does not allow execution to be restarted. These recovery techniques 
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can use external bus related model-specific information provided with the error report to localize the source of the 
error within the system and determine the appropriate recovery strategy. 


16.10.4 Machine-Check Software Handler Guidelines for Error Recovery 


16.10.4.1 Machine-Check Exception Handler for Error Recovery 


When writing a machine-check exception (MCE) handler to support software recovery from Uncorrected Recover- 
able (UCR) errors, consider the following: 


When IA32_MCG_CAP [24] is zero, there are no recoverable errors supported and all machine-check are fatal 
exceptions. The logging of status and error information is therefore a baseline implementation requirement. 


When IA32_MCG_CAP [24] is 1, certain uncorrected errors called uncorrected recoverable (UCR) errors may be 
software recoverable. The handler can analyze the reported error information, and in some cases attempt to 
recover from the uncorrected error and continue execution. 


For processors on which CPUID reports DisplayFamily_DisplayModel as O6H_OEH and onward, an MCA signal is 
broadcast to all logical processors in the system; see the CPUID instruction in Chapter 3, “Instruction Set 
Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A. Due to the 
potentially shared machine check MSR resources among the logical processors on the same package/core, the 
MCE handler may be required to synchronize with the other processors that received a machine check error and 
serialize access to the machine check registers when analyzing, logging, and clearing the information in the 
machine check registers. 


— On processors that indicate ability for local machine-check exception (MCG_LMCE_P), hardware can choose 
to report the error to only a single logical processor if system software has enabled LMCE by setting 
IA32_MCG_EXT_CTL[LMCE_EN] = 1 as outlined in Section 16.3.1.5. 


The VAL (valid) flag in each IA32_MCi_STATUS register indicates whether the error information in the register 
is valid. If this flag is clear, the registers in that bank do not contain valid error information and should not be 
checked. 


The MCE handler is primarily responsible for processing uncorrected errors. The UC flag in each IA32_M- 
Ci_Status register indicates whether the reported error was corrected (UC=0) or uncorrected (UC=1). The MCE 
handler can optionally log and clear the corrected errors in the MC banks if it can implement software algorithm 
to avoid the undesired race conditions with the CMCI or CMC polling handler. 


For uncorrectable errors, the EIPV flag in the IA32_MCG_STATUS register indicates (when set) that the 
instruction pointed to by the instruction pointer pushed onto the stack when the machine-check exception is 
generated is directly associated with the error. When this flag is cleared, the instruction pointed to may not be 
associated with the error. 


The MCIP flag in the IA32_MCG_STATUS register indicates whether a machine-check exception was generated. 
When a machine check exception is generated, it is expected that the MCIP flag in the IA32_MCG_STATUS 
register is set to 1. If it is not set, this machine check was generated by either an INT 18 instruction or some 
piece of hardware signaling an interrupt with vector 18. 


When IA32_MCG_CAP [24] is 1, the following rules can apply when writing a machine check exception (MCE) 
handler to support software recovery: 


The PCC flag in each IA32_MCi_STATUS register indicates whether recovery from the error is possible for 
uncorrected errors (UC=1). If the PCC flag is set for enabled uncorrected errors (UC=1 and EN=1), recovery is 
not possible. When recovery is not possible, the MCE handler typically records the error information and signals 
the operating system to reset the system. 


The RIPV flag in the IA32_MCG_STATUS register indicates whether restarting the program execution from the 
instruction pointer saved on the stack for the machine check exception is possible. When the RIPV is set, 
program execution can be restarted reliably when recovery is possible. If the RIPV flag is not set, program 
execution cannot be restarted reliably. In this case the recovery algorithm may involve terminating the current 
program execution and resuming an alternate thread of execution upon return from the machine check handler 
when recovery is possible. When recovery is not possible, the MCE handler signals the operating system to 
reset the system. 
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¢ When the EN flag is zero but the VAL and UC flags are one in the IA32_MCi_STATUS register, the reported 
uncorrected error in this bank is not enabled. As uncorrected errors with the EN flag = 0 are not the source of 
machine check exceptions, the MCE handler should log and clear non-enabled errors when the S bit is set and 
should continue searching for enabled errors from the other IA32_MCi_STATUS registers. Note that when 
IA32_MCG_CAP [24] is 0, any uncorrected error condition (VAL =1 and UC=1) including the one with the EN 
flag cleared are fatal and the handler must signal the operating system to reset the system. For the errors that 
do not generate machine check exceptions, the EN flag has no meaning. 


¢ When the VAL flag is one, the UC flag is one, the EN flag is one and the PCC flag is zero in the IA32_MCi_STATUS 
register, the error in this bank is an uncorrected recoverable (UCR) error. The MCE handler needs to examine 
the S flag and the AR flag to find the type of the UCR error for software recovery and determine if software error 
recovery is possible. 


¢ When both the S and the AR flags are clear in the IA32_MCi_STATUS register for the UCR error (VAL=1, UC=1, 
EN=x and PCC=0), the error in this bank is an uncorrected no-action required error (UCNA). UCNA errors are 
uncorrected but do not require any OS recovery action to continue execution. These errors indicate that some 
data in the system is corrupt, but that data has not been consumed and may not be consumed. If that data is 
consumed a non-UCNA machine check exception will be generated. UCNA errors are signaled in the same way 
as corrected machine check errors and the CMCI and CMC polling handler is primarily responsible for handling 
UCNA errors. Like corrected errors, the MCA handler can optionally log and clear UCNA errors as long as it can 
avoid the undesired race condition with the CMCI or CMC polling handler. As UCNA errors are not the source of 
machine check exceptions, the MCA handler should continue searching for uncorrected or software recoverable 
errors in all other MC banks. 


¢ When the S flag in the IA32_MCi_STATUS register is set for the UCR error ((VAL=1, UC=1, EN=1 and PCC=0), 
the error in this bank is software recoverable and it was signaled through a machine-check exception. The AR 
flag in the IA32_MCi_STATUS register further clarifies the type of the software recoverable errors. 


¢ When the AR flag in the IA32_MCi_STATUS register is clear for the software recoverable error (VAL=1, UC=1, 
EN=1, PCC=0 and S=1), the error in this bank is a software recoverable action optional (SRAO) error. The MCE 
handler and the operating system can analyze the IA32_MCi_STATUS [15:0] to implement MCA error code 
specific optional recovery action, but this recovery action is optional. System software can resume the program 
execution from the instruction pointer saved on the stack for the machine check exception when the RIPV flag 
in the IA32_MCG_STATUS register is set. 


° Even if the OVER flag in the IA32_MCi_STATUS register is set for the SRAO error (VAL=1, UC=1, EN=1, PCC=0, 
S=1 and AR=0), the MCE handler can take recovery action for the SRAO error logged in the IA32_MCi_STATUS 
register. Since the recovery action for SRAO errors is optional, restarting the program execution from the 
instruction pointer saved on the stack for the machine check exception is still possible for the overflowed SRAO 
error if the RIPV flag in the IA32_MCG_STATUS is set. 


¢ When the AR flag in the IA32_MCi_STATUS register is set for the software recoverable error (VAL=1, UC=1, 
EN=1, PCC=0 and S=1), the error in this bank is a software recoverable action required (SRAR) error. The MCE 
handler and the operating system must take recovery action in order to continue execution after the machine- 
check exception. The MCA handler and the operating system need to analyze the IA32_MCi_STATUS [15:0] to 
determine the MCA error code specific recovery action. If no recovery action can be performed, the operating 
system must reset the system. 


¢ When the OVER flag in the IA32_MCi_STATUS register is set for the SRAR error (VAL=1, UC=1, EN=1, PCC=0, 
S=1 and AR=1), the MCE handler cannot take recovery action as the information of the SRAR error in the 
IA32_MCi_STATUS register was potentially lost due to the overflow condition. Since the recovery action for 
SRAR errors must be taken, the MCE handler must signal the operating system to reset the system. 


¢ When the MCE handler cannot find any uncorrected (VAL=1, UC=1 and EN=1) or any software recoverable 
errors (VAL=1, UC=1, EN=1, PCC=0 and S=1) in any of the IA32_MCi banks of the processors, this is an 
unexpected condition for the MCE handler and the handler should signal the operating system to reset the 
system. 


° Before returning from the machine-check exception handler, software must clear the MCIP flag in the IA32_MC- 
G_STATUS register. The MCIP flag is used to detect recursion. The machine-check architecture does not support 
recursion. When the processor receives a machine check when MCIP is set, it automatically enters the 
shutdown state. 


Example 16-4 gives pseudocode for an MC exception handler that supports recovery of UCR. 


16-32 Vol. 3B 


MACHINE-CHECK ARCHITECTURE 


Example 16-4. Machine-Check Error Handler Pseudocode Supporting UCR 


MACHINE CHECK HANDLER: (* Called from INT 18 handler *) 
NOERROR = TRUE; 
ProcessorCount = 0; 
IF CPU supports MCA 
THEN 
RESTARTABILITY = TRUE; 
IF (Processor Family = 6 AND DisplayModel > OE€H) OR (Processor Family > 6) 
THEN 
IF (MCG_LMCE = 1) 
MCA_BROADCAST = FALSE; 
ELSE 
MCA_BROADCAST = TRUE; 
Fl; 
Acquire SpinLock; 
ProcessorCount++; (* Allowing one logical processor at a time to examine machine check registers *) 
CALL MCA ERROR PROCESSING; (* returns RESTARTABILITY and NOERROR *) 
ELSE 
MCA_BROADCAST = FALSE; 
(* Implement a rendezvous mechanism with the other processors if necessary *) 
CALL MCA ERROR PROCESSING; 
Fl; 
ELSE (* Pentium(R) processor compatible *) 
READ P5_MC_ADDR 
READ P5_MC_TYPE; 
RESTARTABILITY = FALSE; 
FI; 


IF NOERROR = TRUE 
THEN 
IF NOT (MCG_RIPV = 1 AND MCG_EIPV = 0) 
THEN 
RESTARTABILITY = FALSE; 
Fl 
Fl; 


IF RESTARTABILITY = FALSE 
THEN 
Report RESTARTABILITY to console; 
Reset system; 
Fl; 


IF MCA_BROADCAST = TRUE 
THEN 
IF ProcessorCount = MAX_PROCESSORS 
AND NOERROR = TRUE 
THEN 
Report RESTARTABILITY to console; 
Reset system; 
FI; 
Release SpinLock; 
Wait till Processorcount = MAX_PROCESSRS on system; 
(* implement a timeout and abort function if necessary *) 
Fl; 
CLEAR IA32_MCG_STATUS; 
RESUME Execution; 
(* End of MACHINE CHECK HANDLER*) 


MCA ERROR PROCESSING: (* MCA Error Processing Routine called from MCA Handler *) 
IF MCIP flag in |A32_MCG_STATUS = 0 
THEN (* MCIP=0 upon MCA is unexpected *) 
RESTARTABILITY = FALSE; 
Fl; 
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FOR each bank of machine-check registers 
DO 
CLEAR_MC_BANK = FALSE; 
READ IA32_MCi_STATUS; 
IF VAL Flag in |A32_MCi_STATUS = 1 
THEN 
IF UC Flag in |A32_MCi_STATUS = 1 
THEN 
IF Bit 24 in IA32_MCG_CAP = 0 
THEN (* the processor does not support software error recovery *) 
RESTARTABILITY = FALSE; 
NOERROR = FALSE; 
GOTO LOG MCA REGISTER; 
Fi; 
(* the processor supports software error recovery *) 
IF EN Flag in |A32_MCi_STATUS = 0 AND OVER Flag in |A32_MCi_STATUS=0 
THEN (* It is a spurious MCA Log. Log and clear the register *) 
CLEAR_MC_BANK = TRUE; 
GOTO LOG MCA REGISTER; 
Fi; 
IF PCC = 1 and EN = 1 in IA32_MCi_STATUS 
THEN (* processor context might have been corrupted *) 
RESTARTABILITY = FALSE; 
ELSE (* It is a uncorrected recoverable (UCR) error *) 
IF S Flag in |A32_MCi_STATUS = 0 
THEN 
IF AR Flag in |A32_MCi_STATUS = 0 
THEN (* It is a uncorrected no action required (UCNA) error *) 
GOTO CONTINUE; (* let CMCI and CMC polling handler to process *) 
ELSE 
RESTARTABILITY = FALSE; (* S=0, AR=1 is illegal *) 
Fl 
Fi; 
IF RESTARTABILITY = FALSE 
THEN (* no need to take recovery action if RESTARTABILITY is already false *) 
NOERROR = FALSE; 
GOTO LOG MCA REGISTER; 
Fi; 
(* Sin |A32_MCi_STATUS = 1 *) 
IF AR Flag in |A32_MCi_STATUS = 1 
THEN (* It is a software recoverable and action required (SRAR) error *) 
IF OVER Flag in IA32_MCi_STATUS = 1 
THEN 
RESTARTABILITY = FALSE; 
NOERROR = FALSE; 
GOTO LOG MCA REGISTER; 
Fl 
IF MCACOD Value in IA32_MCi_STATUS is recognized 
AND Current Processor is an Affected Processor 
THEN 
Implement MCACOD specific recovery action; 
CLEAR_MC_BANK = TRUE; 
ELSE 
RESTARTABILITY = FALSE; 
Fi; 
ELSE (* It is a software recoverable and action optional (SRAO) error *) 
IF OVER Flag in IA32_MCi_STATUS = 0 AND 
MCACOD in IA32_MCi_STATUS is recognized 
THEN 
Implement MCACOD specific recovery action; 
Fi; 
CLEAR_MC_BANK = TRUE; 
Fl; AR 
Fl; PCC 
NOERROR = FALSE; 
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GOTO LOG MCA REGISTER; 
ELSE (* It is a corrected error; continue to the next [A32_MCi_STATUS *) 
GOTO CONTINUE; 
Fl; UC 
Fl; VAL 


LOG MCA REGISTER: 


SAVE IA32_MCi_STATUS; 
If MISCV in IA32_MCi_STATUS 
THEN 
SAVE IA32_MCi_MISC; 
Fl; 
IF ADDRV in |A32_MCi_STATUS 
THEN 
SAVE IA32_MCi_ADDR; 
Fl; 
IF CLEAR_MC_BANK = TRUE 
THEN 
SET all O to IA32_MCi_STATUS; 
If MISCV in IA32_MCi_STATUS 
THEN 
SET all 0 to IA32_MCi_MISC; 
Fl; 
IF ADDRV in IA32_MCi_STATUS 
THEN 
SET all 0 to IA32_MCi_ADDR; 
Fl; 
Fl; 
CONTINUE: 


OD; 


(*END FOR *) 
RETURN; 
(* End of MCA ERROR PROCESSING*) 


16.10.4.2 Corrected Machine-Check Handler for Error Recovery 


When writing a corrected machine check handler, which is invoked as a result of CMCI or called from an OS CMC 
Polling dispatcher, consider the following: 


The VAL (valid) flag in each IA32_MCi_STATUS register indicates whether the error information in the register 
is valid. If this flag is clear, the registers in that bank does not contain valid error information and does not need 
to be checked. 


The CMCI or CMC polling handler is responsible for logging and clearing corrected errors. The UC flag in each 
IA32_MCi_Status register indicates whether the reported error was corrected (UC=0) or not (UC=1). 


When IA32_MCG_CAP [24] is one, the CMC handler is also responsible for logging and clearing uncorrected no- 
action required (UCNA) errors. When the UC flag is one but the PCC, S, and AR flags are zero in the IA32_M- 
Ci_STATUS register, the reported error in this bank is an uncorrected no-action required (UCNA) error. In cases 
when SRAO error are signaled as UCNA error via CMCI, software can perform recovery for those errors 
identified in Table 16-16. 


In addition to corrected errors and UCNA errors, the CMC handler optionally logs uncorrected (UC=1 and 
PCC=1), software recoverable machine check errors (UC=1, PCC=0 and S=1), but should avoid clearing those 
errors from the MC banks. Clearing these errors may result in accidentally removing these errors before these 
errors are actually handled and processed by the MCE handler for attempted software error recovery. 


Example 16-5 gives pseudocode for a CMCI handler with UCR support. 
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Example 16-5. Corrected Error Handler Pseudocode with UCR Support 


Corrected Error HANDLER: (* Called from CMCI handler or OS CMC Polling Dispatcher*) 
IF CPU supports MCA 
THEN 
FOR each bank of machine-check registers 
DO 
READ IA32_MCi_STATUS; 
IF VAL flag in |A32_MCi_STATUS = 1 


THEN 
IF UC Flag in |A32_MCi_STATUS = 0 (* It is a corrected error *) 
THEN 
GOTO LOG CMC ERROR; 
ELSE 
IF Bit 24 in IA32_MCG_CAP = 0 
THEN 
GOTO CONTINUE; 
Fi; 
IF S Flag in |A32_MCi_STATUS = 0 AND AR Flag in IA32_MCi_STATUS = 0 
THEN (* It is a uncorrected no action required error *) 
GOTO LOG CMC ERROR 
Fl 
IF EN Flag in |A32_MCi_STATUS = 0 
THEN (* It is a spurious MCA error *) 
GOTO LOG CMC ERROR 
Fi; 
Fi; 
Fi; 
GOTO CONTINUE; 
LOG CMC ERROR: 


SAVE IA32_MCi_STATUS; 
If MISCV Flag in IA32_MCi_STATUS 
THEN 
SAVE IA32_MCi_MISC; 
SET all 0 to IA32_MCi_MISC; 
Fl; 
IF ADDRV Flag in |A32_MCi_STATUS 
THEN 
SAVE IA32_MCi_ADDR; 
SET all 0 to |A32_MCi_ADDR 
Fl; 
SET all 0 to IA32_MCi_STATUS; 
CONTINUE: 
OD; 
( *END FOR *) 
Fl; 
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13.Updates to Chapter 19, Volume 3B 


Change bars and violet text show changes to Chapter 19 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3B: System Programming Guide, Part 2. 


Changes to this chapter: 


e Updated four references to the Last Branch Records Information Leaf (1CH) to remove “ECX = 0” since this 
leaf does not support sub-leaves. 
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CHAPTER 19 
LAST BRANCH RECORDS 


NOTE 


This chapter defines a last-branch recording (LBR) facility that is architectural and part of the Intel 
64 architecture. This facility is an enhancement of but distinct from earlier LBR facilities that were 
not architectural. Those earlier facilities are documented in Chapter 18. 


Support of the architectural LBR feature in a logical processor is reported in CPUID.(EAX=07H, 
ECX=0H):EDX[19]=1. When the architectural LBR feature is supported, capability details like the number of LBR 
records that are available is indicated in CPUID.1CH:EAX[7:0]. The number of LBR records available varies across 
processor generations, so software should only access the available LBR records indicated by 
CPUID.1CH:EAX[7:0]. 


Last Branch Records (LBRs) enable recording of software path history by logging taken branches and other control 
flow transfers within processor registers. Each LBR record or entry is comprised of three MSRs: 


¢ JA32_LBR_x_FROM_IP — Holds the source IP of the operation. 
¢ JIA32_LBR_x_TO_IP — Holds the destination IP of the operation. 


¢ JA32_LBR_x_INFO — Holds metadata for the operation, including mispredict, TSX, and elapsed cycle time infor- 
mation. 


LBR records are stored in age order. The most recent LBR entry is stored in IA32_LBR_O_*, the next youngest in 
IA32_LBR_1_*, and so on. When an operation to be recorded completes (retires) with LBRs enabled 
(IA32_LBR_CTL.LBREn=1), older LBR entries are shifted in the LBR array by one entry, then a record of the new 
operation is written into entry 0. See Section 19.1.1 for the list of recorded operations. 


The number of LBR entries available for recording operations is dictated by the value in IA32_LBR_DEPTH.DEPTH. 
By default, the DEPTH value matches the maximum number of LBRs supported by the processor, but software may 
opt to use fewer in order to achieve reduced context switch latency. 


In addition to the LBRs, there is a single Last Event Record (LER). It records the last taken branch preceding the 
last exception, hardware interrupt, or software interrupt. Like LBRs, the LER is comprised of three MSRs 
(IA32_LER_FROM_IP, IA32_LER_TO_IP, IA32_LER_INFO), and is subject to the same dependencies on enabling 
and filtering. 


Which operations are recorded in LBRs depends upon a series of factors: 
¢ Branch Type Filtering — Software must opt in to the types of branches to be logged; see Section 19.1.2.3. 
* Current Privilege Level (CPL) — LBRs can be filtered based on CPL; see Section 19.1.2.5. 


e LBR Freeze — LBR and LER recording can be suspended by setting IA32_PERF_GLOBAL_STATUS.LBR_FRZ to 1. 
See Section 18.4.7 for details on LBR_FRZ. 


On some implementations, recording LBRs may require constraining the number of operations that can complete in 
a cycle. As a result, on these implementations, enabling LBRs may have some performance overhead. 


19.1 BEHAVIOR 


19.1.1. Logged Operations 
LBRs can log most control flow transfer operations. 


The source IP recorded for a branch instruction is the IP of that instruction. For events that take place between 
instructions, the source IP recorded is the IP of the next sequential instruction. 


The destination IP recorded is always the target of the branch or event, the next instruction that will execute. 
The full list of operations and the respective IPs recorded is shown in Table 19-1. 
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Table 19-1. LBR IP Values for Various Operations 


Operation FROM_IP TO_IP 

Taken Branch!, Exception, INT3, INTn, | Current IP Target IP 

INTO, TSX Abort 

Interrupt Next IP Target IP 

INIT (BSP) Next IP Reset Vector 

INIT (AP) + SIPI Next IP SIPI Vector 
EENTER/ERESUME + EEXIT/AEX Current IP Target or Trampoline IP 
RSM¢ Target IP Target IP 

#DB, #SMI, VM exit, VM entry None None 
NOTES: 


1. Direct CALLs with displacement zero, for which the target is typically the next sequential IP, are not treated as 
taken branches by LBRs. 
2. RSM is only recorded in LBRs when IA32_DEBUGCTL.FREEZE_WHILE_SMM is set to 0. 


19.1.2 Configuration 


19.1.2.1 Enabling and Disabling 
LBRs are enabled by setting IA32_LBR_CTL.LBREn to 1. 


Some operations, such as entry to a secure mode like SMM or Intel SGX, can cause LBRs to be temporarily 
disabled. Other operations, such as debug exceptions or some SMX operations, disable LBRs and require software 
to re-enable them. Details on these interactions can be found in Section 19.1.4. 


19.1.2.2 LBR Depth 


The number of LBRs used by the processor can be constrained by modifying the IA32_LBR_DEPTH.DEPTH value. 
DEPTH defaults to the maximum number of LBRs supported by the processor. Allowed DEPTH values can be found 
in CPUID.1CH:EAX[7:0]. 


Reducing the LBR depth can result in improved performance, by reducing the number of LBRs that need to be read 
and/or context switched. 


On a software write to IA32_LBR_DEPTH, all LBR entries are reset to 0. LERs are not impacted. 


A RDMSR or WRMSR to any IA32_LBR_x_* MSRs, such that x = DEPTH, will generate a #GP exception. Note that 
the XSAVES and XRSTORS instructions access only the LBRs associated with entries 0 to DEPTH-1. 


By clearing the LBR entries on writes to IA32_LBR_DEPTH, and forbidding any software writes to LBRs 2 DEPTH, it 
is thereby guaranteed that any LBR entries equal to or above DEPTH will have value 0. 


19.1.2.3. Branch Type Enabling and Filtering 


Software must opt in to the types of branches that are desired to be recorded. These elections are made in 
IA32_LBR_CTL; see Section 19.2. Branch type options are listed in Table 19-2; only those enabled will be recorded. 
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Table 19-2. Branch Type Filtering Details 


Branch Type Operations Recorded 

COND Jec, J*CXZ, and LOOP* 

NEAR_IND_JMP JMP r/m* 

NEAR_REL_JMP JMP rel* 

NEAR_IND_CALL CALL r/m* 

NEAR_REL_CALL CALL rel* (excluding CALLs to the next sequential IP) 

NEAR_RET RET (OC3H) 

OTHER_BRANCH JMP/CALL ptr*, JMP/CALL m*, RET (OC8H), SYS*, interrupts, exceptions (other than debug 
exceptions), IRET, INT3, INTn, INTO, TSX Abort, EENTER, ERESUME, EEXIT, AEX, INIT, SIPI, RSM 


These encodings match those in IA32_LBR_x_INFO.BR_TYPE. 
Control flow transfers that are not recorded include #DB, VM exit, VM entry, and #SMI. 


19.1.2.4  Call-Stack Mode 


The LBR array is, by default, treated as a ring buffer that captures control flow transitions. However, the finite 
depth of the LBR array can be limiting when profiling certain high-level languages (e.g., C++), where a transition 
of the execution flow is accompanied by a large number of leaf function calls. These calls to leaf functions, and their 
returns, are likely to displace the main execution context from the LBRs. 


When call-stack mode is enabled, the LBR array can capture unfiltered call data normally, but as return instructions 
are executed the last captured branch (call) record is flushed from the LBRs in a last-in first-out (LIFO) manner. 
Thus, branch information pertaining to completed leaf functions will not be retained, while preserving the call stack 
information of the main line execution path. 


Call-stack mode is enabled by setting IA32_LBR_CTL.CALL_STACK to 1. When enabled, near RET instructions 
receive special treatment. Rather than adding a new record in LBR_O, a near RET will instead “pop” the CALL entry 
at LBR_O by shifting entries LBR_1..LBR_[DEPTH-1] up to LBR_0..LBR_[DEPTH-2], and clearing LBR_[DEPTH-1] to 
0. Thus, LBR processing software can consume only valid call-stack entries by reading until finding an entry that is 
all zeros. 


Call-stack mode should be used with branch type enabling configured to capture only CALLs (NEAR_REL_CALL and 
NEAR_IND_CALL) and RETs (NEAR_RET). When configured in this manner, the LBR array emulates a call stack, 
where CALLs are “pushed” and RETs “pop” them off the stack. If other branch types (JCC, NEAR_*_JMP, or 
OTHER_BRANCH) are enabled for recording with call-stack mode, LBR behavior may be undefined. 


It is recommended that call-stack mode be used along with CPL filtering, by setting at most one of the OS and USR 
bits in the IA32_LBR_CTL MSR. Call-stack mode does not emulate the stack switch that can occur on CPL transi- 
tions, and hence monitoring all CPLs may result in a corrupted LBR call stack. 


Call-Stack Mode and LBR Freeze 


When IA32_DEBUGCTL.FREEZE_LBRS_ON_PMI=1, IA32_PERF_GLOBAL_STATUS.LBR_FRZ will be set to 1 when a 
PMI is pended. That will cause LBRs and LERs to cease recording branches until LBR_FRZ is cleared. Because there 
may be some “skid”, or instructions retiring, in between the PMI being pended and the PMI being taken, it is 
possible that some branches may be missing from the LBRs. In the case of call-stack mode, if a CALL or RET is 
missed, that can lead to confusing results where CALL entries fail to get “popped” off the stack, and RETs “pop” the 
wrong CALLs. 


An alternative is to utilize CPL filtering to limit LBR recording to less privileged modes only (CPL>3) instead of using 
the FREEZE_LBRS_ON_PMI=1 feature. This will record branches in the “skid”, but avoid recording any branches in 
the privilege level 0 handler. 


Vol. 3B 19-3 


LAST BRANCH RECORDS 


19.1.2.5 CPL Filtering 


Software must opt in to which CPL(s) will have branches recorded. If IA32_LBR_CTL.OS=1, then branches in 
CPL=0 can be recorded. If IA32_LBR_CTL.USR=1, then branches in CPL>0 can be recorded. For operations which 
change the CPL, the operation is recorded in LBRs only if the CPL at the end of the operation is enabled for LBR 
recording. In cases where the CPL transitions from a value that is filtered out to a value that is enabled for LBR 
recording, the FROM_IP address for the recorded CPL transition branch or event will be OFFFFFFFFFFFFFFFFH. 


19.1.3. Record Data 


19.1.3.1 IP Fields 


The source and destination IP values in IA32_LBR_x_[FROM|TO]_IP and IA32_LER_x_[FROM|TO]_IP may hold 
effective IPs or linear IPs (LIPs), depending on the processor generation. The effective IP is the offset from the CS 
base address, while LIP includes the CS base address. Which IP type is used is indicated in CPUID.1CH:EAX[bit 31]. 


The value read from this field will always be canonical. Note that this includes the case where a canonical violation 
(#GP) results from executing sequential code that runs precisely to the end of the lower canonical address space 

(where IP[63:MAXLINADDR-1] is 0, but IP[MAXLINADDR-2:0] is all ones). In this case, the FROM_IP will hold the 
lowest canonical address in the upper canonical space, such that IP[63:MAXLINADDR-1] is all ones, and IP[MAXLI- 
NADDR-2:0] is 0. 


In some cases, due to CPL filtering, the FROM_IP of the recorded operation may be filtered out. In this case 
OFFFFFFFFFFFFFFFFH will be recorded. See Section 19.1.2.5 for details. 


Writes of these fields will be forced canonical, such that the processor ignores the value written to the upper bits 
(IP[63:MAXLINADDR-1}). 


19.1.3.2 Branch Types 


The IA32_LBR_x_INFO.BR_TYPE and IA32_LER_INFO.BR_TYPE fields encode the branch types as shown in Table 
19-3. 


Table 19-3. IA32_LBR_x_INFO and IA32_LER_INFO Branch Type Encodings 


Encoding Branch Type 
0000B COND 

0001B NEAR_IND_JMP 
0010B NEAR_REL_JMP 
0011B NEAR_IND_CALL 
0100B NEAR_REL_CALL 
0101B NEAR_RET 
011xB Reserved 

1XxxB OTHER_BRANCH 


For a list of branch operations that fall into the categories above, see Table 19-2. In future generations, BR_TYPE 
bits 2:0 may be used to distinguish between differing types of OTHER_BRANCH. 


19.1.3.3 Cycle Time 


Each time an operation is recorded in an LBR, the value of the LBR cycle timer is recorded in 
IA32_LBR_x_INFO.CYC_CNT. The LBR cycle timer is a saturating counter that counts at the processor clock rate. 
Each time an operation is recorded in an LBR, the counter is reset but continues counting. 
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There is an LBR cycle counter valid bit, IA32_LBR_x_INFO.CYC_CNT_VALID. When set, the CYC_CNT field holds a 
valid value, the number of elapsed cycles since the last operation recorded in an LBR (up to OFFFFH). 


Some implementations may opt to reduce the granularity of the CYC_CNT field for larger values. The implication of 
this is that the least significant bits may be forced to 1 in cases where the count has reached some minimum 
threshold. It is guaranteed that this reduced granularity will never result in an inaccuracy of more than 10%. 


19.1.3.4 Mispredict Information 


IA32_LBR_x_INFO.MISPRED provides an indication of whether the recorded branch was predicted incorrectly by 
the processor. The bit is set if either the taken/not-taken direction of a conditional branch was mispredicted, or if 
the target of an indirect branch was mispredicted. 


19.1.3.5 Intel® TSX Information 


IA32_LBR_x_INFO.IN_TSX indicates whether the operation recorded retired during a TSX transaction. 
IA32_LBR_x_INFO.TSX_ABORT indicates that the operation is a TSX Abort. 


19.1.4 Interaction with Other Processor Features 


19.1.4.1 SMM 


IA32_LBR_CTL.LBREn is saved and cleared on #SMI, and restored on RSM. As a result of disabling LBRs, the #SMI 
is not recorded. RSM is recorded only if IA32_DEBUGCTL.FREEZE_WHILE_SMM is set to 0, and the FROM_IP will be 
set to the same value as the TO_IP. 


19.1.4.2 SMM Transfer Monitor (STM) 


LBREn is not cleared on #SMI when it causes SMM VM exit. Instead, the STM should use the VMCS controls 
described in Section 19.1.4.3 to disable LBRs while in SMM, and to restore them on VM entries that exit SMM. 


On VMCALL to configure STM, IA32_LBR_CTL is cleared. 


19.1.4.3 VMX 


By default, LBR operation persists across VMX transitions. However, VMCS fields have been added to enable 
constraining LBR usage to within non-root operation only. See details in Table 19-4. 


Table 19-4. LBR VMCS Fields 


Name Type Bit Position | Behavior 

Guest IA32_LBR_CTL Guest State Field | NA The guest value of [A32_LBR_CTL is written to this field on all 
VM exits. 

Load Guest IA32_LBR_CTL | Entry Control 21 When set, VM entry will write the value from the “Guest 
IA32_LBR_CTL” guest state field to IA32_LBR_CTL. 

Clear IA32_LBR_CTL Exit Control 26 When set, VM exit will clear |A32_LBR_CTL after the value has 
been saved to the “Guest [A32_LBR_CTL” quest state field. 


To enable “guest-only” LBR use, a VMM should set both the “Load Guest IA32_LBR_CTL” entry control and the 
“Clear IA32_LBR_CTL” exit control. For “system-wide” LBR use, where LBRs remain enabled across host and 
guest(s), a VMM should keep both new VMCS controls clear. 


VM entry checks that, if the “Load Guest IA32_LBR_CTL” entry control is 1, bits reserved in the IA32_LBR_CTLMSR 
must be 0 in the field for that register. 
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For additional information relating to VMX transitions, see Chapter 25, Chapter 27, and Chapter 28 in the Intel® 64 
and IA-32 Architectures Software Developer’s Manual, Volume 3C. 


19.1.4.4 Intel® SGX 


On entry to an enclave, via EENTER or ERESUME, logging of LBR entries is suspended. On enclave exit, via EEXIT 
or AEX, logging resumes. The cycle counter will continue to run during enclave execution. 


An exception to the above is made for opt-in debug enclaves. For such enclaves, LBR logging is not impacted. 


19.1.4.5 Debug Exceptions 


When a branch happens because of a #DB exception, IA32_LBR_CTL.LBREn is cleared. As a result, the operation is 
not recorded. 


19.1.4.46 SMX 
On GETSEC leaves SENTER or ENTERACCS, IA32_LBR_CTL is cleared. As a result, the operation is not recorded. 


19.1.4.7. MWAIT 


On an MWAIT that requests a C-state deeper than C1, IA32_LBR_x_* MSRs may be cleared to 0. IA32_LBR_CTL, 
IA32_LBR_DEPTH, and IA32_LER_* MSRs will be preserved. 


For an MWAIT that enters a C-state equal to or less deep than C1, and all C-states that enter as a result of Hard- 
ware Duty Cycling (HDC), all LBR MSRs are preserved. 


19.1.4.8 Processor Event-Based Sampling (PEBS) 


PEBS records can be configured to include LBRs, by setting PEBS_DATA_CFG.LBREn[3]=1. The number of LBRs to 
include in the record is also configurable, via PEBS_DATA_CFG.NUM_LBRS[28:24]. For details on PEBS, see Section 
20.9 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3B. 


If NUM_LBRS is set to a value greater than LBR_DEPTH, then only LBR_DEPTH entries will be written into the PEBS 
record. Further, the Record Size field will be decreased to match the actual size of the record to be written, and the 
Record Format field will replace the value of NUM_LBRS with the value of LBR_DEPTH. These adjustments ensure 
that software is able to properly interpret the PEBS record. 


19.2 MSRS 


The MSRs that represent the LBR entries (IA32_LBR_x_[TO|FROM|INFO]) and the LER entry 
(IA32_LER_[TO|FROM|INFO}]) do not fault on writes. Any address field written will force sign-extension based on 
the maximum linear address width supported by the processor, and any non-zero value written to undefined bits 
may be ignored such that subsequent reads return 0. 


On a warm reset, all LBR MSRs, including IA32_LBR_DEPTH, have their values preserved. However, 
IA32_LBR_CTL.LBREn is cleared to O, disabling LBRs. If a warm reset is triggered while the processor is in the C6 
idle state, also known as warm init, all LBR MSRs will be reset to their initial values. 


See Table 2-2 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for details on LBR 
MSRs. 


19.3. FAST LBR READ ACCESS 


XSAVES provides a faster means than RDMSR for software to read all LBRs. When using XSAVES for reading LBRs 
rather than for context switch, software should take care to ensure that XSAVES does not write LBR state to an area 
of memory that has been or will be used by XRSTORS. This could corrupt INIT tracking. 
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19.4 OTHER IMPACTS 


19.4.1 Branch Trace Store on Intel Atom® Processors 


Branch Trace Store (BTS) on Intel Atom processors that support the architectural form of the LBR feature has 
dependencies on the LBR configuration. BTS will store out the LBR_O (TOS) record each time a taken branch or 
event retires. If any filtering of LBRs is employed, or if LBRs are disabled, some duplicate entries may be stored by 
BTS. Like LBRs and LERs, BTS is suspended when IA32_PERF_GLOBAL_STATUS.LBR_FRZ is set to 1. 


BTS will change to cease issuing branch records for direct near CALLs with displacement zero to align with LBR 
behavior. 


19.4.2 1A32_DEBUGCTL 


On processors that do not support model-specific LBRs, IA32_DEBUGCTL[bit 0] has no meaning. It can be written 
to 0 or 1, but reads will always return 0. 


19.4.3. 1IA32_PERF_CAPABILITIES 


On processors that do not support model-specific LBRs, IA32_PERF_CAPABILITIES.LBR_FMT will have the value 
O3FH. 
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14.Updates to Chapter 23, Volume 3B 


Change bars and violet text show changes to Chapter 23 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3B: System Programming Guide, Part 2. 


Changes to this chapter: 

e Corrected information in Section 23.18.9, “Obsolete Instructions and Undefined Opcodes.” 

e Corrected the “device not available” exception called out in Section 23.20.2, “Intel486 SX Processor and Intel 
487 SX Math Coprocessor Initialization.” Previously, this exception was listed as #NH in the documentation. 
The correct exception is #NM. 
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CHAPTER 23 
ARCHITECTURE COMPATIBILITY 


Intel 64 and IA-32 processors are binary compatible. Compatibility means that, within limited constraints, 
programs that execute on previous generations of processors will produce identical results when executed on later 
processors. The compatibility constraints and any implementation differences between the Intel 64 and IA-32 
processors are described in this chapter. 


Each new processor has enhanced the software visible architecture from that found in earlier Intel 64 and IA-32 
processors. Those enhancements have been defined with consideration for compatibility with previous and future 
processors. This chapter also summarizes the compatibility considerations for those extensions. 


23.1 PROCESSOR FAMILIES AND CATEGORIES 


IA-32 processors are referred to in several different ways in this chapter, depending on the type of compatibility 
information being related, as described in the following: 


¢ IA-32 Processors — All the Intel processors based on the Intel IA-32 Architecture, which include the 
8086/88, Intel 286, Intel386, Intel486, Pentium, Pentium Pro, Pentium II, Pentium III, Pentium 4, and Intel 
Xeon processors. 


° 32-bit Processors — All the IA-32 processors that use a 32-bit architecture, which include the Intel386, 
Intel486, Pentium, Pentium Pro, Pentium II, Pentium Ill, Pentium 4, and Intel Xeon processors. 


* 16-bit Processors — All the IA-32 processors that use a 16-bit architecture, which include the 8086/88 and 
Intel 286 processors. 


° P6 Family Processors — All the IA-32 processors that are based on the P6 microarchitecture, which include 
the Pentium Pro, Pentium II, and Pentium Ill processors. 


* Pentium® 4 Processors — A family of IA-32 and Intel 64 processors that are based on the Intel NetBurst® 
microarchitecture. 


* Intel® Pentium® M Processors — A family of IA-32 processors that are based on the Intel Pentium M 
processor microarchitecture. 


* Intel® Core™ Duo and Solo Processors — Families of IA-32 processors that are based on an improved Intel 
Pentium M processor microarchitecture. 


* Intel® Xeon® Processors — A family of IA-32 and Intel 64 processors that are based on the Intel NetBurst 
microarchitecture. This family includes the Intel Xeon processor and the Intel Xeon processor MP based on the 
Intel NetBurst microarchitecture. Intel Xeon processors 3000, 3100, 3200, 3300, 3200, 5100, 5200, 5300, 
5400, 7200, 7300 series are based on Intel Core microarchitectures and support Intel 64 architecture. 


* Pentium® D Processors — A family of dual-core Intel 64 processors that provides two processor cores in a 
physical package. Each core is based on the Intel NetBurst microarchitecture. 


* Pentium® Processor Extreme Editions — A family of dual-core Intel 64 processors that provides two 
processor cores in a physical package. Each core is based on the Intel NetBurst microarchitecture and supports 
Intel Hyper-Threading Technology. 


* Intel® Core™ 2 Processor family— A family of Intel 64 processors that are based on the Intel Core microar- 
chitecture. Intel Pentium Dual-Core processors are also based on the Intel Core microarchitecture. 


* Intel Atom® Processors — A family of IA-32 and Intel 64 processors. 45 nm Intel Atom processors are based 
on the Intel Atom microarchitecture. 32 nm Intel Atom processors are based on newer microarchitectures 
including the Silvermont microarchitecture and the Airmont microarchitecture. Each generation of Intel Atom 
processors can be identified by the CPUID’s DisplayFamily_DisplayModel signature; see Table 2-1 “CPUID 
Signature Values of DisplayFamily_DisplayModel” in Chapter 2, “Model-Specific Registers (MSRs),” of the Intel® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 4. 
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23.2 RESERVED BITS 


Throughout this manual, certain bits are marked as reserved in many register and memory layout descriptions. 
When bits are marked as undefined or reserved, it is essential for compatibility with future processors that software 
treat these bits as having a future, though unknown effect. Software should follow these guidelines in dealing with 
reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers or memory locations that 
contain such bits. Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing them to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 


¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, or 
reload them with values previously read from the same register. 


Software written for existing IA-32 processor that handles reserved bits correctly will port to future IA-32 proces- 
sors without generating protection exceptions. 


23.3. ENABLING NEW FUNCTIONS AND MODES 


Most of the new control functions defined for the P6 family and Pentium processors are enabled by new mode flags 
in the control registers (primarily register CR4). This register is undefined for IA-32 processors earlier than the 
Pentium processor. Attempting to access this register with an Intel486 or earlier IA-32 processor results in an 
invalid-opcode exception (#UD). Consequently, programs that execute correctly on the Intel486 or earlier IA-32 
processor cannot erroneously enable these functions. Attempting to set a reserved bit in register CR4 to a value 
other than its original value results in a general-protection exception (#GP). So, programs that execute on the P6 
family and Pentium processors cannot erroneously enable functions that may be implemented in future IA-32 
processors. 


The P6 family and Pentium processors do not check for attempts to set reserved bits in model-specific registers; 
however these bits may be checked on more recent processors. It is the obligation of the software writer to enforce 
this discipline. These reserved bits may be used in future Intel processors. 


23.4 DETECTING THE PRESENCE OF NEW FEATURES THROUGH SOFTWARE 


Software can check for the presence of new architectural features and extensions in either of two ways: 


1. Test for the presence of the feature or extension. Software can test for the presence of new flags in the EFLAGS 
register and control registers. If these flags are reserved (meaning not present in the processor executing the 
test), an exception is generated. Likewise, software can attempt to execute a new instruction, which results in 
an invalid-opcode exception (#UD) being generated if it is not supported. 


2. Execute the CPUID instruction. The CPUID instruction (added to the IA-32 in the Pentium processor) indicates 
the presence of new features directly. 


See Chapter 20, “Processor Identification and Feature Determination,” in the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 1, for detailed information on detecting new processor features and exten- 
sions. 


23.5 INTEL MMX TECHNOLOGY 


The Pentium processor with MMX technology introduced the MMX technology and a set of MMX instructions to the 
IA-32. The MMX instructions are described in Chapter 9, “Programming with Intel® MMX™ Technology,” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, and in the Intel® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D. The MMX technology and MMxX instructions are 
also included in the Pentium II, Pentium III, Pentium 4, and Intel Xeon processors. 
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23.6 STREAMING SIMD EXTENSIONS (SSE) 


The Streaming SIMD Extensions (SSE) were introduced in the Pentium III processor. The SSE extensions consist of 
a new set of instructions and a new set of registers. The new registers include the eight 128-bit XMM registers and 
the 32-bit MXCSR control and status register. These instructions and registers are designed to allow SIMD compu- 
tations to be made on single precision floating-point numbers. Several of these new instructions also operate in the 
MMX registers. SSE instructions and registers are described in Section 10, “Programming with Intel® Streaming 
SIMD Extensions (Intel® SSE),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, 
and in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D. 


23.7. STREAMING SIMD EXTENSIONS 2 (SSE2) 


The Streaming SIMD Extensions 2 (SSE2) were introduced in the Pentium 4 and Intel Xeon processors. They 
consist of a new set of instructions that operate on the XMM and MXCSR registers and perform SIMD operations on 
double precision floating-point values and on integer values. Several of these new instructions also operate in the 
MMxX registers. SSE2 instructions and registers are described in Chapter 11, “Programming with Intel® Streaming 
SIMD Extensions 2 (Intel® SSE2),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1, and in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D. 


23.8 STREAMING SIMD EXTENSIONS 3 (SSE3) 


The Streaming SIMD Extensions 3 (SSE3) were introduced in Pentium 4 processors supporting Intel Hyper- 
Threading Technology and Intel Xeon processors. SSE3 extensions include 13 instructions. Ten of these 13 instruc- 
tions support the single instruction multiple data (SIMD) execution model used with SSE/SSE2 extensions. One 
SSE3 instruction accelerates x87 style programming for conversion to integer. The remaining two instructions 
(MONITOR and MWAIT) accelerate synchronization of threads. SSE3 instructions are described in Chapter 12, 
“Programming with Intel® SSE3, SSSE3, Intel® SSE4, and Intel® AES-NI,” in the Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volume 1, and in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volumes 2A, 2B, 2C, & 2D. 


23.9 ADDITIONAL STREAMING SIMD EXTENSIONS 


The Supplemental Streaming SIMD Extensions 3 (SSSE3) were introduced in the Intel Core 2 processor and Intel 
Xeon processor 5100 series. Streaming SIMD Extensions 4 provided 54 new instructions introduced in 45 nm Intel 
Xeon processors and Intel Core 2 processors. SSSE3, SSE4.1 and SSE4.2 instructions are described in Chapter 12, 
“Programming with Intel® SSE3, SSSE3, Intel® SSE4, and Intel® AES-NI,” in the Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volume 1, and in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volumes 2A, 2B, 2C, & 2D. 


23.10 INTEL HYPER-THREADING TECHNOLOGY 


Intel Hyper-Threading Technology provides two logical processors that can execute two separate code streams 
(called threads) concurrently by using shared resources in a single processor core or in a physical package. 


This feature was introduced in the Intel Xeon processor MP and later steppings of the Intel Xeon processor, and 
Pentium 4 processors supporting Intel Hyper-Threading Technology. The feature is also found in the Pentium 
processor Extreme Edition. See also: Section 9.7, “Intel® Hyper-Threading Technology Architecture.” 


45 nm and 32 nm Intel Atom processors support Intel Hyper-Threading Technology. 


Intel Atom processors based on Silvermont and Airmont microarchitectures do not support Intel Hyper-Threading 
Technology. 
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23.11 MULTI-CORE TECHNOLOGY 


The Pentium D processor and Pentium processor Extreme Edition provide two processor cores in each physical 
processor package. See also: Section 9.5, “Intel® Hyper-Threading Technology and Intel® Multi-Core Technology,” 
and Section 9.8, “Multi-Core Architecture.” Intel Core 2 Duo, Intel Pentium Dual-Core processors, Intel Xeon 
processors 3000, 3100, 5100, 5200 series provide two processor cores in each physical processor package. Intel 
Core 2 Extreme, Intel Core 2 Quad processors, Intel Xeon processors 3200, 3300, 5300, 5400, 7300 series provide 
two processor cores in each physical processor package. 


23.12 SPECIFIC FEATURES OF DUAL-CORE PROCESSOR 
Dual-core processors may have some processor-specific features. Use CPUID feature flags to detect the availability 
features. Note the following: 


¢ CPUID Brand String — On Pentium processor Extreme Edition, the process will report the correct brand string 
only after the correct microcode updates are loaded. 


¢ Enhanced Intel SpeedStep Technology — This feature is supported in Pentium D processor but not in 
Pentium processor Extreme Edition. 


23.13 NEW INSTRUCTIONS IN THE PENTIUM AND LATER IA-32 PROCESSORS 


Table 23-1 identifies the instructions introduced into the IA-32 in the Pentium processor and later IA-32 processors. 


23.13.1 Instructions Added Prior to the Pentium Processor 
The following instructions were added in the Intel486 processor: 

¢ BSWAP (byte swap) instruction. 

¢ XADD (exchange and add) instruction. 

* CMPXCHG (compare and exchange) instruction. 

¢ INVD (invalidate cache) instruction. 

¢ WBINVD (write-back and invalidate cache) instruction. 

¢ INVLPG (invalidate TLB entry) instruction. 


Table 23-1. New Instruction in the Pentium Processor and Later IA-32 Processors 


Instruction CPUID Identification Bits Introduced In 
CMOVcc (conditional move) EDX, Bit 15 Pentium Pro processor 
FCMOVcc (floating-point conditional move) EDX, Bits 0 and 15 
FCOMI (floating-point compare and set EFLAGS) EDX, Bits O and 15 
RDPMC (read performance monitoring counters) EAX, Bits 8-11, set to 6H; 
see Note 1 
UD2 (undefined) EAX, Bits 8-11, set to 6H 
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Table 23-1. New Instruction in the Pentium Processor and Later IA-32 Processors (Contd.) 


Instruction CPUID Identification Bits Introduced In 
CMPXCHG8B (compare and exchange 8 bytes) EDX, Bit 8 Pentium processor 
CPUID (CPU identification) None; see Note 2 
RDTSC (read time-stamp counter) EDX, Bit 4 
RDMSR (read model-specific register) EDX, Bit 5 
WRMSR (write model-specific register) EDX, Bit 5 
MMX Instructions EDX, Bit 23 


NOTES: 


1. The RDPMC instruction was introduced in the P6 family of processors and added to later model Pentium processors. This instruc- 
tion is model specific in nature and not architectural. 


2. The CPUID instruction is available in all Pentium and P6 family processors and in later models of the Intel486 processors. The ability 
to set and clear the ID flag (bit 21) in the EFLAGS register indicates the availability of the CPUID instruction. 


The following instructions were added in the Intel386 processor: 

e LSS, LFS, and LGS (load SS, FS, and GS registers). 

¢ Long-displacement conditional jumps. 

° ~=Single-bit instructions. 

¢ Bit scan instructions. 

* Double-shift instructions. 

¢ Byte set on condition instruction. 

° Move with sign/zero extension. 

¢ Generalized multiply instruction. 

¢ MOV to and from control registers. 

¢ MOV to and from test registers (now obsolete). 

¢ MOV to and from debug registers. 

¢ RSM (resume from SMM). This instruction was introduced in the Intel386 SL and Intel486 SL processors. 
The following instructions were added in the Intel 387 math coprocessor: 
°  FPREM1. 

¢ FUCOM, FUCOMP, and FUCOMPP. 


23.14 OBSOLETE INSTRUCTIONS 


The MOV to and from test registers instructions were removed from the Pentium processor and future IA-32 
processors. Execution of these instructions generates an invalid-opcode exception (#UD). 


23.15 UNDEFINED OPCODES 


All new instructions defined for Intel 64 and IA-32 processors use binary encodings that were reserved on earlier- 
generation processors. Generally, attempting to execute a reserved opcode results in an invalid-opcode (#UD) 
exception being generated. Consequently, programs that execute correctly on earlier-generation processors 
cannot erroneously execute these instructions and thereby produce unexpected results when executed on later 
Intel 64 processors. 


For compatibility with prior generations, there are a few reserved opcodes which do not result in a #UD but rather 
result in the same behavior as certain defined instructions. In the interest of standardization, it is recommended 
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that software not use the opcodes given below but instead use those defined in the Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D. 


The following items enumerate those reserved opcodes (referring in some cases to opcode groups as defined in 

Appendix A, “Opcode Map,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D). 

* Immediate Group 1 - When not in 64-bit mode, instructions encoded with opcode 82H result in the behavior 
of the corresponding instructions encoded with opcode 80H. Depending on the Op/Reg field of the ModR/M 
Byte, these opcodes are the byte forms of ADD, OR, ADC, SBB, AND, SUB, XOR, CMP. (In 64-bit mode, these 
opcodes cause a #UD.) 

¢ Shift Group 2 /6 - Instructions encoded with opcodes COH, C1H, DOH, D1H, D2H, and D3H with value 110B in 
the Op/Reg field (/6) of the ModR/M Byte result in the behavior of the corresponding instructions with value 
100B in the Op/Reg field (/4). These are various forms of the SAL/SHL instruction. 

¢ Unary Group 3 /1 - Instructions encoded with opcodes F6H and F7H with value 001B in the Op/Reg field (/01) 
of the ModR/M Byte result in the behavior of the corresponding instructions with value O00B in the Op/Reg field 
(/0). These are various forms of the TEST instruction. 

* Reserved NOP - Instructions encoded with the opcode OFODH or with the opcodes OF18H through OF1FH 
result in the behavior of the NOP (No Operation) instruction, except for those opcodes defined in the Intel® 64 
and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D. The opcodes not so defined 
are considered “Reserved NOP” and may be used for future instructions which have no defined impact on 
existing architectural state. These reserved NOP opcodes are decoded with a ModR/M byte and typical 
instruction prefix options but still result in the behavior of the NOP instruction. 

° x87 Opcodes - There are several groups of x87 opcodes which provide the same behavior as other x87 
instructions. See Section 23.18.9 for the complete list. 


There are a few reserved opcodes that provide unique behavior but do not provide capabilities that are not already 
available in the main instructions defined in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volumes 2A, 2B, 2C, & 2D. 


° D6H - When not in 64-bit mode SALC - Set AL to Cary flag. IF (CF=1), AL=FF, ELSE, AL=0 (#UD in 64-bit 
mode) 


° x87 Opcodes - There are a few x87 opcodes with subtly different behavior from existing x87 instructions. See 
Section 23.18.9 for details. 


23.16 NEW FLAGS IN THE EFLAGS REGISTER 


The section titled “EFLAGS Register” in Chapter 3, “Basic Execution Environment,” of the Intel® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 1, shows the configuration of flags in the EFLAGS register for the P6 
family processors. No new flags have been added to this register in the P6 family processors. The flags added to 
this register in the Pentium and Intel486 processors are described in the following sections. 


The following flags were added to the EFLAGS register in the Pentium processor: 
¢ VIF (virtual interrupt flag), bit 19. 

¢ VIP (virtual interrupt pending), bit 20. 

¢ ID (identification flag), bit 21. 

The AC flag (bit 18) was added to the EFLAGS register in the Intel486 processor. 


23.16.1 Using EFLAGS Flags to Distinguish Between 32-Bit IA-32 Processors 


The following bits in the EFLAGS register that can be used to differentiate between the 32-bit IA-32 processors: 


¢ Bit 18 (the AC flag) can be used to distinguish an Intel386 processor from the P6 family, Pentium, and Intel486 
processors. Since it is not implemented on the Intel386 processor, it will always be clear. 


¢ Bit 21 (the ID flag) indicates whether an application can execute the CPUID instruction. The ability to set and 
clear this bit indicates that the processor is a P6 family or Pentium processor. The CPUID instruction can then 
be used to determine which processor. 


23-6 Vol. 3B 


ARCHITECTURE COMPATIBILITY 


¢ Bits 19 (the VIF flag) and 20 (the VIP flag) will always be zero on processors that do not support virtual mode 
extensions, which includes all 32-bit processors prior to the Pentium processor. 


See Chapter 20, “Processor Identification and Feature Determination,” in the Intel® 64 and IA-32 Architectures 
Software Developer’s Manual, Volume 1, for more information on identifying processors. 


23.17 STACK OPERATIONS AND USER SOFTWARE 


This section identifies the differences in stack implementation between the various IA-32 processors. 


23.17.1 PUSH SP 


The P6 family, Pentium, Intel486, Intel386, and Intel 286 processors push a different value on the stack for a PUSH 
SP instruction than the 8086 processor. The 32-bit processors push the value of the SP register before it is decre- 
mented as part of the push operation; the 8086 processor pushes the value of the SP register after it is decre- 
mented. If the value pushed is important, replace PUSH SP instructions with the following three instructions: 


PUSH BP 
MOV BP, SP 
XCHG BP, [BP] 


This code functions as the 8086 processor PUSH SP instruction on the P6 family, Pentium, Intel486, Intel386, and 
Intel 286 processors. 


23.17.2 EFLAGS Pushed on the Stack 


The setting of the stored values of bits 12 through 15 (which includes the IOPL field and the NT flag) in the EFLAGS 
register by the PUSHF instruction, by interrupts, and by exceptions is different with the 32-bit IA-32 processors 
than with the 8086 and Intel 286 processors. The differences are as follows: 


* 8086 processor—bits 12 through 15 are always set. 
¢ Intel 286 processor—bits 12 through 15 are always cleared in real-address mode. 


¢ 32-bit processors in real-address mode—bit 15 (reserved) is always cleared, and bits 12 through 14 have the 
last value loaded into them. 


23.18 X87 FPU 


This section addresses the issues that must be faced when porting floating-point software designed to run on 
earlier IA-32 processors and math coprocessors to a Pentium 4, Intel Xeon, P6 family, or Pentium processor with 
integrated x87 FPU. To software, a Pentium 4, Intel Xeon, or P6 family processor looks very much like a Pentium 
processor. Floating-point software which runs on a Pentium or Intel486 DX processor, or on an Intel486 SX 
processor/Intel 487 SX math coprocessor system or an Intel386 processor/Intel 387 math coprocessor system, 
will run with at most minor modifications on a Pentium 4, Intel Xeon, or P6 family processor. To port code directly 
from an Intel 286 processor/Intel 287 math coprocessor system or an Intel 8086 processor/8087 math copro- 
cessor system to a Pentium 4, Intel Xeon, P6 family, or Pentium processor, certain additional issues must be 
addressed. 


In the following sections, the term “32-bit x87 FPUs” refers to the P6 family, Pentium, and Intel486 DX processors, 
and to the Intel 487 SX and Intel 387 math coprocessors; the term “16-bit IA-32 math coprocessors” refers to the 
Intel 287 and 8087 math coprocessors. 
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23.18.1 Control Register CRO Flags 


The ET, NE, and MP flags in control register CRO control the interface between the integer unit of an IA-32 processor 
and either its internal x87 FPU or an external math coprocessor. The effect of these flags in the various IA-32 
processors are described in the following paragraphs. 


The ET (extension type) flag (bit 4 of the CRO register) is used in the Intel386 processor to indicate whether the 
math coprocessor in the system is an Intel 287 math coprocessor (flag is clear) or an Intel 387 DX math copro- 
cessor (flag is set). This bit is hardwired to 1 in the P6 family, Pentium, and Intel486 processors. 


The NE (Numeric Exception) flag (bit 5 of the CRO register) is used in the P6 family, Pentium, and Intel486 proces- 
sors to determine whether unmasked floating-point exceptions are reported internally through interrupt vector 16 
(flag is set) or externally through an external interrupt (flag is clear). On a hardware reset, the NE flag is initialized 
to 0, so software using the automatic internal error-reporting mechanism must set this flag to 1. This flag is nonex- 
istent on the Intel386 processor. 


As on the Intel 286 and Intel386 processors, the MP (monitor coprocessor) flag (bit 1 of register CRO) determines 
whether the WAIT/FWAIT instructions or waiting-type floating-point instructions trap when the context of the x87 
FPU is different from that of the currently-executing task. If the MP and TS flag are set, then a WAIT/FWAIT instruc- 
tion and waiting instructions will cause a device-not-available exception (interrupt vector 7). The MP flag is used on 
the Intel 286 and Intel386 processors to support the use of a WAIT/FWAIT instruction to wait on a device other 
than a math coprocessor. The device reports its status through the BUSY# pin. Since the P6 family, Pentium, and 
Intel486 processors do not have such a pin, the MP flag has no relevant use and should be set to 1 for normal oper- 
ation. 


23.18.2 x87 FPU Status Word 


This section identifies differences to the x87 FPU status word for the different IA-32 processors and math coproces- 
sors, the reason for the differences, and their impact on software. 


23.18.2.1 Condition Code Flags (CO through C3) 


The following information pertains to differences in the use of the condition code flags (CO through C3) located in 
bits 8, 9, 10, and 14 of the x87 FPU status word. 


After execution of an FINIT instruction or a hardware reset on a 32-bit x87 FPU, the condition code flags are set to 
0. The same operations on a 16-bit IA-32 math coprocessor leave these flags intact (they contain their prior value). 
This difference in operation has no impact on software and provides a consistent state after reset. 


Transcendental instruction results in the core range of the P6 family and Pentium processors may differ from the 
Intel486 DX processor and Intel 487 SX math coprocessor by 2 to 3 units in the last place (ulps)—(see “Transcen- 
dental Instruction Accuracy” in Chapter 8, “Programming with the x87 FPU,” of the Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volume 1). As a result, the value saved in the Ci flag may also differ. 


After an incomplete FPREM/FPREM1 instruction, the CO, Ci, and C3 flags are set to 0 on the 32-bit x87 FPUs. After 
the same operation on a 16-bit IA-32 math coprocessor, these flags are left intact. 


On the 32-bit x87 FPUs, the C2 flag serves as an incomplete flag for the FTAN instruction. On the 16-bit IA-32 math 
coprocessors, the C2 flag is undefined for the FPTAN instruction. This difference has no impact on software, 
because Intel 287 or 8087 programs do not check C2 after an FPTAN instruction. The use of this flag on later 
processors allows fast checking of operand range. 


23.18.2.2 Stack Fault Flag 


When unmasked stack overflow or underflow occurs on a 32-bit x87 FPU, the IE flag (bit 0) and the SF flag (bit 6) 
of the x87 FPU status word are set to indicate a stack fault and condition code flag C1 is set or cleared to indicate 
overflow or underflow, respectively. When unmasked stack overflow or underflow occurs on a 16-bit IA-32 math 
coprocessor, only the IE flag is set. Bit 6 is reserved on these processors. The addition of the SF flag on a 32-bit x87 
FPU has no impact on software. Existing exception handlers need not change, but may be upgraded to take advan- 
tage of the additional information. 
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23.18.3 x87 FPU Control Word 


Only affine closure is supported for infinity control on a 32-bit x87 FPU. The infinity control flag (bit 12 of the x87 
FPU control word) remains programmable on these processors, but has no effect. This change was made to 
conform to the IEEE Standard 754 for Floating-Point Arithmetic. On a 16-bit IA-32 math coprocessor, both affine 
and projective closures are supported, as determined by the setting of bit 12. After a hardware reset, the default 
value of bit 12 is projective. Software that requires projective infinity arithmetic may give different results. 


23.18.4 x87 FPU Tag Word 


When loading the tag word of a 32-bit x87 FPU, using an FLDENV, FRSTOR, or FXRSTOR (Pentium III processor only) 
instruction, the processor examines the incoming tag and classifies the location only as empty or non-empty. Thus, 
tag values of 00, 01, and 10 are interpreted by the processor to indicate a non-empty location. The tag value of 11 
is interpreted by the processor to indicate an empty location. Subsequent operations on a non-empty register 
always examine the value in the register, not the value in its tag. The FSTENV, FSAVE, and FXSAVE (Pentium III 
processor only) instructions examine the non-empty registers and put the correct values in the tags before storing 
the tag word. 


The corresponding tag for a 16-bit IA-32 math coprocessor is checked before each register access to determine the 
class of operand in the register; the tag is updated after every change to a register so that the tag always reflects 
the most recent status of the register. Software can load a tag with a value that disagrees with the contents of a 
register (for example, the register contains a valid value, but the tag says special). Here, the 16-bit IA-32 math 
coprocessors honor the tag and do not examine the register. 


Software written to run on a 16-bit IA-32 math coprocessor may not operate correctly on a 16-bit x87 FPU, if it 
uses the FLDENV, FRSTOR, or FXRSTOR instructions to change tags to values (other than to empty) that are 
different from actual register contents. 


The encoding in the tag word for the 32-bit x87 FPUs for unsupported data formats (including pseudo-zero and 
unnormal) is special (10B), to comply with IEEE Standard 754. The encoding in the 16-bit IA-32 math coprocessors 
for pseudo-zero and unnormal is valid (OOB) and the encoding for other unsupported data formats is special (10B). 
Code that recognizes the pseudo-zero or unnormal format as valid must therefore be changed if it is ported to a 32- 
bit x87 FPU. 


23.18.5 Data Types 


This section discusses the differences of data types for the various x87 FPUs and math coprocessors. 


23.18.5.1 NaNs 


The 32-bit x87 FPUs distinguish between signaling NaNs (SNaNs) and quiet NaNs (QNaNs). These x87 FPUs only 
generate QNaNs and normally do not generate an exception upon encountering a QNaN. An invalid-operation 
exception (#1) is generated only upon encountering a SNaN, except for the FCOM, FIST, and FBSTP instructions, 
which also generates an invalid-operation exceptions for a QNaNs. This behavior matches IEEE Standard 754. 


The 16-bit IA-32 math coprocessors only generate one kind of NaN (the equivalent of a QNaN), but the raise an 
invalid-operation exception upon encountering any kind of NaN. 


When porting software written to run on a 16-bit IA-32 math coprocessor to a 32-bit x87 FPU, uninitialized memory 
locations that contain QNaNs should be changed to SNaNs to cause the x87 FPU or math coprocessor to fault when 
uninitialized memory locations are referenced. 


23.18.5.2 Pseudo-zero, Pseudo-NaN, Pseudo-infinity, and Unnormal Formats 


The 32-bit x87 FPUs neither generate nor support the pseudo-zero, pseudo-NaN, pseudo-infinity, and unnormal 
formats. Whenever they encounter them in an arithmetic operation, they raise an invalid-operation exception. The 
16-bit IA-32 math coprocessors define and support special handling for these formats. Support for these formats 
was dropped to conform with IEEE Standard 754 for Floating-Point Arithmetic. 
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This change should not impact software ported from 16-bit IA-32 math coprocessors to 32-bit x87 FPUs. The 32- 
bit x87 FPUs do not generate these formats, and therefore will not encounter them unless software explicitly loads 
them in the data registers. The only affect may be in how software handles the tags in the tag word (see also: 
Section 23.18.4, “x87 FPU Tag Word”). 


23.18.6 Floating-Point Exceptions 


This section identifies the implementation differences in exception handling for floating-point instructions in the 
various x87 FPUs and math coprocessors. 


23.18.6.1 Denormal Operand Exception (#D) 


When the denormal operand exception is masked, the 32-bit x87 FPUs automatically normalize denormalized 
numbers when possible; whereas, the 16-bit IA-32 math coprocessors return a denormal result. A program written 
to run on a 16-bit IA-32 math coprocessor that uses the denormal exception solely to normalize denormalized 
operands is redundant when run on the 32-bit x87 FPUs. If such a program is run on 32-bit x87 FPUs, performance 
can be improved by masking the denormal exception. Floating-point programs run faster when the FPU performs 
normalization of denormalized operands. 


The denormal operand exception is not raised for transcendental instructions and the FXTRACT instruction on the 
16-bit IA-32 math coprocessors. This exception is raised for these instructions on the 32-bit x87 FPUs. The excep- 
tion handlers ported to these latter processors need to be changed only if the handlers gives special treatment to 
different opcodes. 


23.18.6.2 Numeric Overflow Exception (#0) 


On the 32-bit x87 FPUs, when the numeric overflow exception is masked and the rounding mode is set to chop 
(toward 0), the result is the largest positive or smallest negative number. The 16-bit IA-32 math coprocessors do 
not signal the overflow exception when the masked response is not ~; that is, they signal overflow only when the 
rounding control is not set to round to O. If rounding is set to chop (toward 0), the result is positive or negative ~. 
Under the most common rounding modes, this difference has no impact on existing software. 


If rounding is toward 0 (chop), a program on a 32-bit x87 FPU produces, under overflow conditions, a result that is 
different in the least significant bit of the significand, compared to the result on a 16-bit IA-32 math coprocessor. 
The reason for this difference is IEEE Standard 754 compatibility. 


When the overflow exception is not masked, the precision exception is flagged on the 32-bit x87 FPUs. When the 
result is stored in the stack, the significand is rounded according to the precision control (PC) field of the FPU 
control word or according to the opcode. On the 16-bit IA-32 math coprocessors, the precision exception is not 
flagged and the significand is not rounded. The impact on existing software is that if the result is stored on the 
stack, a program running on a 32-bit x87 FPU produces a different result under overflow conditions than on a 16- 
bit IA-32 math coprocessor. The difference is apparent only to the exception handler. This difference is for IEEE 
Standard 754 compatibility. 


23.18.6.3 Numeric Underflow Exception (#U) 


When the underflow exception is masked on the 32-bit x87 FPUs, the underflow exception is signaled when the 
result is tiny and inexact (see Section 4.9.1.5, “Numeric Underflow Exception (#U),” in Intel® 64 and IA-32 Archi- 
tectures Software Developer’s Manual, Volume 1). When the underflow exception is unmasked and the instruction 
is supposed to store the result on the stack, the significand is rounded to the appropriate precision (according to 
the PC flag in the FPU control word, for those instructions controlled by PC, otherwise to extended precision), after 
adjusting the exponent. 


23.18.6.4 Exception Precedence 


There is no difference in the precedence of the denormal-operand exception on the 32-bit x87 FPUs, whether it be 
masked or not. When the denormal-operand exception is not masked on the 16-bit IA-32 math coprocessors, it 
takes precedence over all other exceptions. This difference causes no impact on existing software, but some 
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unneeded normalization of denormalized operands is prevented on the Intel486 processor and Intel 387 math 
coprocessor. 


23.18.6.5 CS and EIP For FPU Exceptions 


On the Intel 32-bit x87 FPUs, the values from the CS and EIP registers saved for floating-point exceptions point to 
any prefixes that come before the floating-point instruction. On the 8087 math coprocessor, the saved CS and IP 
registers points to the floating-point instruction. 


23.18.6.6 FPU Error Signals 


The floating-point error signals to the P6 family, Pentium, and Intel486 processors do not pass through an interrupt 
controller; an INT# signal from an Intel 387, Intel 287 or 8087 math coprocessors does. If an 8086 processor uses 
another exception for the 8087 interrupt, both exception vectors should call the floating-point-error exception 
handler. Some instructions in a floating-point-error exception handler may need to be deleted if they use the inter- 
rupt controller. The P6 family, Pentium, and Intel486 processors have signals that, with the addition of external 
logic, support reporting for emulation of the interrupt mechanism used in many personal computers. 


On the P6 family, Pentium, and Intel486 processors, an undefined floating-point opcode will cause an invalid- 
opcode exception (#UD, interrupt vector 6). Undefined floating-point opcodes, like legal floating-point opcodes, 
cause a device not available exception (#NM, interrupt vector 7) when either the TS or EM flag in control register 
CRO is set. The P6 family, Pentium, and Intel486 processors do not check for floating-point error conditions on 
encountering an undefined floating-point opcode. 


23.18.6.7 Assertion of the FERR# Pin 


When using the MS-DOS compatibility mode for handing floating-point exceptions, the FERR# pin must be 
connected to an input to an external interrupt controller. An external interrupt is then generated when the FERR# 
output drives the input to the interrupt controller and the interrupt controller in turn drives the INTR pin on the 
processor. 


For the P6 family and Intel386 processors, an unmasked floating-point exception always causes the FERR# pin to 
be asserted upon completion of the instruction that caused the exception. For the Pentium and Intel486 proces- 
sors, an unmasked floating-point exception may cause the FERR# pin to be asserted either at the end of the 
instruction causing the exception or immediately before execution of the next floating-point instruction. (Note that 
the next floating-point instruction would not be executed until the pending unmasked exception has been 
handled.) See Appendix D, “Guidelines for Writing SIMD Floating-Point Exception Handlers,” in the Intel® 64 and 
IA-32 Architectures Software Developer’s Manual, Volume 1, for a complete description of the required mechanism 
for handling floating-point exceptions using the MS-DOS compatibility mode. 


Using FERR# and IGNNE#¥ to handle floating-point exception is deprecated by modern operating systems; this 
approach also limits newer processors to operate with one logical processor active. 


23.18.6.8 Invalid Operation Exception On Denormals 


An invalid-operation exception is not generated on the 32-bit x87 FPUs upon encountering a denormal value when 
executing a FSQRT, FDIV, or FPREM instruction or upon conversion to BCD or to integer. The operation proceeds by 
first normalizing the value. On the 16-bit IA-32 math coprocessors, upon encountering this situation, the invalid- 
operation exception is generated. This difference has no impact on existing software. Software running on the 32- 
bit x87 FPUs continues to execute in cases where the 16-bit IA-32 math coprocessors trap. The reason for this 
change was to eliminate an exception from being raised. 


23.18.6.9 Alignment Check Exceptions (#AC) 


If alignment checking is enabled, a misaligned data operand on the P6 family, Pentium, and Intel486 processors 
causes an alignment check exception (#AC) when a program or procedure is running at privilege-level 3, except 
for the stack portion of the FSAVE/FNSAVE, FXSAVE, FRSTOR, and FXRSTOR instructions. 
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23.18.6.10 Segment Not Present Exception During FLDENV 


On the Intel486 processor, when a segment not present exception (#NP) occurs in the middle of an FLDENV 
instruction, it can happen that part of the environment is loaded and part not. In such cases, the FPU control word 
is left with a value of OO7FH. The P6 family and Pentium processors ensure the internal state is correct at all times 
by attempting to read the first and last bytes of the environment before updating the internal state. 


23.18.6.11 Device Not Available Exception (#NM) 


The device-not-available exception (#NM, interrupt 7) will occur in the P6 family, Pentium, and Intel486 processors 
as described in Section 2.5, “Control Registers,” Table 2-2, and Chapter 6, “Interrupt 7—Device Not Available 
Exception (#NM).” 


23.18.6.12 Coprocessor Segment Overrun Exception 


The coprocessor segment overrun exception (interrupt 9) does not occur in the P6 family, Pentium, and Intel486 
processors. In situations where the Intel 387 math coprocessor would cause an interrupt 9, the P6 family, Pentium, 
and Intel486 processors simply abort the instruction. To avoid undetected segment overruns, it is recommended 
that the floating-point save area be placed in the same page as the TSS. This placement will prevent the FPU envi- 
ronment from being lost if a page fault occurs during the execution of an FLDENV, FRSTOR, or FXRSTOR instruction 
while the operating system is performing a task switch. 


23.18.6.13 General Protection Exception (#GP) 


A general-protection exception (#GP, interrupt 13) occurs if the starting address of a floating-point operand falls 
outside a segment’s size. An exception handler should be included to report these programming errors. 


23.18.6.14 Floating-Point Error Exception (#MF) 


In real mode and protected mode (not including virtual-8086 mode), interrupt vector 16 must point to the floating- 
point exception handler. In virtual-8086 mode, the virtual-8086 monitor can be programmed to accommodate a 
different location of the interrupt vector for floating-point exceptions. 


23.18.7 Changes to Floating-Point Instructions 


This section identifies the differences in floating-point instructions for the various Intel FPU and math coprocessor 
architectures, the reason for the differences, and their impact on software. 


23.18.7.1 FDIV, FPREM, and FSQRT Instructions 


The 32-bit x87 FPUs support operations on denormalized operands and, when detected, an underflow exception 
can occur, for compatibility with the IEEE Standard 754. The 16-bit IA-32 math coprocessors do not operate on 
denormalized operands or return underflow results. Instead, they generate an invalid-operation exception when 
they detect an underflow condition. An existing underflow exception handler will require change only if it gives 
different treatment to different opcodes. Also, it is possible that fewer invalid-operation exceptions will occur. 


23.18.7.2 FSCALE Instruction 


With the 32-bit x87 FPUs, the range of the scaling operand is not restricted. If (0 < | ST(1) < 1), the scaling factor 
is O; therefore, ST(O0) remains unchanged. If the rounded result is not exact or if there was a loss of accuracy 
(masked underflow), the precision exception is signaled. With the 16-bit IA-32 math coprocessors, the range of the 
scaling operand is restricted. If (0 < | ST(1) | < 1), the result is undefined and no exception is signaled. The 
impact of this difference on exiting software is that different results are delivered on the 32-bit and 16-bit FPUs and 
math coprocessors when (0 < | ST(1) | < 1). 
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23.18.7.3  FPREM1 Instruction 


The 32-bit x87 FPUs compute a partial remainder according to IEEE Standard 754. This instruction does not exist 
on the 16-bit IA-32 math coprocessors. The availability of the FPREM1 instruction has is no impact on existing soft- 
ware. 


23.18.7.4 FPREM Instruction 


On the 32-bit x87 FPUs, the condition code flags CO, C3, C1 in the status word correctly reflect the three low-order 
bits of the quotient following execution of the FPREM instruction. On the 16-bit IA-32 math coprocessors, the 
quotient bits are incorrect when performing a reduction of (64% + M) when (N > 1) and M is 1 or 2. This difference 
does not affect existing software; software that works around the bug should not be affected. 


23.18.7.5 FUCOM, FUCOMP, and FUCOMPP Instructions 


When executing the FUCOM, FUCOMP, and FUCOMPP instructions, the 32-bit x87 FPUs perform unordered compare 
according to IEEE Standard 754. These instructions do not exist on the 16-bit IA-32 math coprocessors. The avail- 
ability of these new instructions has no impact on existing software. 


23.18.7.6 FPTAN Instruction 


On the 32-bit x87 FPUs, the range of the operand for the FPTAN instruction is much less restricted (| ST(0) | < 23) 
than on earlier math coprocessors. The instruction reduces the operand internally using an internal x/4 constant 
that is more accurate. The range of the operand is restricted to (| ST(0) | < 2/4) on the 16-bit IA-32 math copro- 
cessors; the operand must be reduced to this range using FPREM. This change has no impact on existing software. 
See also sections 8.3.8 and section 8.3.10 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 1, for more information on the accuracy of the FPTAN instruction. 


23.18.7.7 Stack Overflow 


On the 32-bit x87 FPUs, if an FPU stack overflow occurs when the invalid-operation exception is masked, the FPU 
returns the real, integer, or BCD-integer indefinite value to the destination operand, depending on the instruction 
being executed. On the 16-bit IA-32 math coprocessors, the original operand remains unchanged following a stack 
overflow, but it is loaded into register ST(1). This difference has no impact on existing software. 


23.18.7.8 FSIN, FCOS, and FSINCOS Instructions 


On the 32-bit x87 FPUs, these instructions perform three common trigonometric functions. These instructions do 
not exist on the 16-bit IA-32 math coprocessors. The availability of these instructions has no impact on existing 
software, but using them provides a performance upgrade. See also sections 8.3.8 and section 8.3.10 of the Intel® 
64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for more information on the accuracy of the 
FSIN, FCOS, and FSINCOS instructions. 


23.18.7.9 FPATAN Instruction 


On the 32-bit x87 FPUs, the range of operands for the FPATAN instruction is unrestricted. On the 16-bit IA-32 math 
coprocessors, the absolute value of the operand in register ST(0) must be smaller than the absolute value of the 
operand in register ST(1). This difference has impact on existing software. 


23.18.7.10 F2XM1 Instruction 


The 32-bit x87 FPUs support a wider range of operands (-1 < ST (0) < + 1) for the F2XM1 instruction. The 
supported operand range for the 16-bit IA-32 math coprocessors is (0 < ST(0) <0.5). This difference has no impact 
on existing software. 
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23.18.7.11 FLD Instruction 


On the 32-bit x87 FPUs, when using the FLD instruction to load an extended-real value, a denormal-operand excep- 
tion is not generated because the instruction is not arithmetic. The 16-bit IA-32 math coprocessors do report a 
denormal-operand exception in this situation. This difference does not affect existing software. 


On the 32-bit x87 FPUs, loading a denormal value that is in single- or double-real format causes the value to be 
converted to extended-real format. Loading a denormal value on the 16-bit IA-32 math coprocessors causes the 
value to be converted to an unnormal. If the next instruction is FXTRACT or FXAM, the 32-bit x87 FPUs will give a 
different result than the 16-bit IA-32 math coprocessors. This change was made for IEEE Standard 754 compati- 
bility. 

On the 32-bit x87 FPUs, loading an SNaN that is in single- or double-real format causes the FPU to generate an 
invalid-operation exception. The 16-bit IA-32 math coprocessors do not raise an exception when loading a signaling 
NaN. The invalid-operation exception handler for 16-bit math coprocessor software needs to be updated to handle 
this condition when porting software to 32-bit FPUs. This change was made for IEEE Standard 754 compatibility. 


23.18.7.12 FXTRACT Instruction 


On the 32-bit x87 FPUs, if the operand is 0 for the FXTRACT instruction, the divide-by-zero exception is reported 
and -- is delivered to register ST(1). If the operand is +o, no exception is reported. If the operand is 0 on the 16- 
bit IA-32 math coprocessors, 0 is delivered to register ST(1) and no exception is reported. If the operand is +0, the 
invalid-operation exception is reported. These differences have no impact on existing software. Software usually 
bypasses 0 and ~. This change is due to the IEEE Standard 754 recommendation to fully support the “logb” func- 
tion. 


23.18.7.13 Load Constant Instructions 


On 32-bit x87 FPUs, rounding control is in effect for the load constant instructions. Rounding control is not in effect 
for the 16-bit IA-32 math coprocessors. Results for the FLDPI, FLDLN2, FLDLG2, and FLDL2E instructions are the 
same as for the 16-bit IA-32 math coprocessors when rounding control is set to round to nearest or round to +>. 
They are the same for the FLDL2T instruction when rounding control is set to round to nearest, round to --9, or 
round to zero. Results are different from the 16-bit IA-32 math coprocessors in the least significant bit of the 
mantissa if rounding control is set to round to --° or round to O for the FLDPI, FLDLN2, FLDLG2, and FLDL2E instruc- 
tions; they are different for the FLDL2T instruction if round to +-9 is specified. These changes were implemented for 
compatibility with IEEE Standard 754 for Floating-Point Arithmetic recommendations. 


23.18.7.14 FXAM Instruction 


With the 32-bit x87 FPUs, if the FPU encounters an empty register when executing the FXAM instruction, it not 
generate combinations of CO through C3 equal to 1101 or 1111. The 16-bit IA-32 math coprocessors may generate 
these combinations, among others. This difference has no impact on existing software; it provides a performance 
upgrade to provide repeatable results. 


23.18.7.15 FSAVE and FSTENV Instructions 


With the 32-bit x87 FPUs, the address of a memory operand pointer stored by FSAVE or FSTENV is undefined if the 
previous floating-point instruction did not refer to memory 


23.18.8 Transcendental Instructions 


The floating-point results of the P6 family and Pentium processors for transcendental instructions in the core range 
may differ from the Intel486 processors by about 2 or 3 ulps (see “Transcendental Instruction Accuracy” in Chapter 
8, “Programming with the x87 FPU,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
1). Condition code flag C1 of the status word may differ as a result. The exact threshold for underflow and overflow 
will vary by a few ulps. The P6 family and Pentium processors’ results will have a worst case error of less than 1 ulp 
when rounding to the nearest-even and less than 1.5 ulps when rounding in other modes. The transcendental 
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instructions are guaranteed to be monotonic, with respect to the input operands, throughout the domain supported 
by the instruction. 


Transcendental instructions may generate different results in the round-up flag (C1) on the 32-bit x87 FPUs. The 
round-up flag is undefined for these instructions on the 16-bit IA-32 math coprocessors. This difference has no 
impact on existing software. 


23.18.9 Obsolete Instructions and Undefined Opcodes 


The 8087 math coprocessor instructions FENI and FDISI, and the Intel 287 math coprocessor instruction FSETPM 
are treated as integer NOP instructions in the 32-bit x87 FPUs. If these opcodes are detected in the instruction 
stream, no specific operation is performed and no internal states are affected. FSETPM informed the Intel 287 math 
coprocessor that the processor was in protected mode. The 32-bit x87 FPUs handle all addressing and exception- 
pointer information, whether in protected mode or not. 


For compatibility with prior generations there are a few reserved x87 opcodes which do not result in an invalid- 
opcode (#UD) exception, but rather result in the same behavior as existing defined x87 instructions. In the interest 
of standardization, it is recommended that the opcodes defined in the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, be used for these operations for standardization. 


¢ DCDOH through DCD7H - Behaves the same as FCOM, D8DOH through D8D7H. 
¢ DCD8H through DCDFH - Behaves the same as FCOMP, D8D8H through D8DFH. 
¢ DDC8H through DDCFH - Behaves the same as FXCH, D9C8H through D9CFH. 
¢ DEDOH through DED7H - Behaves the same as FCOMP, D8D8H through D8DFH. 
¢ DFDOH through DFD7H - Behaves the same as FSTP, DDD8H through DDDFH. 
¢ DFC8H through DFCFH - Behaves the same as FXCH, D9C8H through D9CFH. 
¢ DFD8H through DFDFH - Behaves the same as FSTP, DDD8H through DDDFH. 


There are a few reserved x87 opcodes which provide unique behavior but do not provide capabilities which are not 

already available in the main instructions defined in the Intel® 64 and IA-32 Architectures Software Developer’s 

Manual, Volumes 2A, 2B, 2C, & 2D. 

® D9D8H through D9DFH - Behaves the same as FSTP (DDD8H through DDDFH) but won't cause a stack 
underflow exception. 


¢ DFCOH through DFC7H - Behaves the same as FFREE (DDCOH through DDD7H) with the addition of an x87 
stack POP. 


23.18.10 WAIT/FWAIT Prefix Differences 


On the Intel486 processor, when a WAIT/FWAIT instruction precedes a floating-point instruction (one which itself 
automatically synchronizes with the previous floating-point instruction), the WAIT/FWAIT instruction is treated as 
a no-op. Pending floating-point exceptions from a previous floating-point instruction are processed not on the 
WAIT/FWAIT instruction but on the floating-point instruction following the WAIT/FWAIT instruction. In such a case, 
the report of a floating-point exception may appear one instruction later on the Intel486 processor than on a P6 
family or Pentium FPU, or on Intel 387 math coprocessor. 


23.18.11 Operands Split Across Segments and/or Pages 


On the P6 family, Pentium, and Intel486 processor FPUs, when the first half of an operand to be written is inside a 
page or segment and the second half is outside, a memory fault can cause the first half to be stored but not the 
second half. In this situation, the Intel 387 math coprocessor stores nothing. 


23.18.12 FPU Instruction Synchronization 


On the 32-bit x87 FPUs, all floating-point instructions are automatically synchronized; that is, the processor auto- 
matically waits until the previous floating-point instruction has completed before completing the next floating-point 
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instruction. No explicit WAIT/FWAIT instructions are required to assure this synchronization. For the 8087 math 
coprocessors, explicit waits are required before each floating-point instruction to ensure synchronization. Although 
8087 programs having explicit WAIT instructions execute perfectly on the 32-bit IA-32 processors without reas- 
sembly, these WAIT instructions are unnecessary. 


23.19 SERIALIZING INSTRUCTIONS 


Certain instructions have been defined to serialize instruction execution to ensure that modifications to flags, regis- 
ters, and memory are completed before the next instruction is executed (or in P6 family processor terminology 
“committed to machine state”). Because the P6 family processors use branch-prediction and out-of-order execu- 
tion techniques to improve performance, instruction execution is not generally serialized until the results of an 
executed instruction are committed to machine state (see Chapter 2, “Intel® 64 and IA-32 Architectures,” in the 
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). 


As aresult, at places in a program or task where it is critical to have execution completed for all previous instruc- 
tions before executing the next instruction (for example, at a branch, at the end of a procedure, or in multipro- 
cessor dependent code), it is useful to add a serializing instruction. See Section 9.3, “Serializing Instructions,” for 
more information on serializing instructions. 


23.20 FPU AND MATH COPROCESSOR INITIALIZATION 


Table 10-1 shows the states of the FPUs in the P6 family, Pentium, Intel486 processors and of the Intel 387 math 
coprocessor and Intel 287 coprocessor following a power-up, reset, or INIT, or following the execution of an 
FINIT/FNINIT instruction. The following is some additional compatibility information concerning the initialization of 
x87 FPUs and math coprocessors. 


23.20.1 Intel® 387 and Intel® 287 Math Coprocessor Initialization 


Following an Intel386 processor reset, the processor identifies its coprocessor type (Intel® 287 or Intel® 387 DX 
math coprocessor) by sampling its ERROR# input some time after the falling edge of RESET# signal and before 
execution of the first floating-point instruction. The Intel 287 coprocessor keeps its ERROR# output in inactive 
state after hardware reset; the Intel 387 coprocessor keeps its ERROR# output in active state after hardware 
reset. 


Upon hardware reset or execution of the FINIT/FNINIT instruction, the Intel 387 math coprocessor signals an error 
condition. The P6 family, Pentium, and Intel486 processors, like the Intel 287 coprocessor, do not. 


23.20.2 Intel486 SX Processor and Intel 487 SX Math Coprocessor Initialization 


When initializing an Intel486 SX processor and an Intel 487 SX math coprocessor, the initialization routine should 
check the presence of the math coprocessor and should set the FPU related flags (EM, MP, and NE) in control 
register CRO accordingly (see Section 2.5, “Control Registers,” for a complete description of these flags). Table 23-2 
gives the recommended settings for these flags when the math coprocessor is present. The FSTCW instruction will 
give a value of FFFFH for the Intel486 SX microprocessor and 037FH for the Intel 487 SX math coprocessor. 
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Table 23-2. Recommended Values of the EM, MP, and NE Flags for Intel486 SX Microprocessor/Intel 487 SX Math 


Coprocessor System 
CRO Flags Intel486 SX Processor Only Intel 487 SX Math Coprocessor Present 
EM 1 0 
MP 0 1 
NE 1 0, for MS-DOS* systems 
1, for user-defined exception handler 


The EM and MP flags in register CRO are interpreted as shown in Table 23-3. 


Table 23-3. EM and MP Flag Interpretation 


EM MP Interpretation 

0 0 Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions 
ignore TS. 

0 1 Floating-point instructions are passed to FPU; WAIT/FWAIT and other waiting-type instructions 
test TS. 

1 0 Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions 
ignore TS. 

1 1 Floating-point instructions trap to emulator; WAIT/FWAIT and other waiting-type instructions 
test TS. 


Following is an example code sequence to initialize the system and check for the presence of Intel486 SX 
processor/Intel 487 SX math coprocessor. 


fninit 

fstcw mem_loc 

mov ax, mem_loc 

cmp ax, 037fh 

jz Intel487_SX_Math_CoProcessor_present ;ax=037fh 
jmp Intel486_SX_microprocessor_present sax=ffffh 


If the Intel 487 SX math coprocessor is not present, the following code can be run to set the CRO register for the 
Intel486 SX processor. 


mov eax, crO 

and eax, fffffffdh ;make MP=0 

or eax, 0024h imake EM=1, NE=1 
mov crO, eax 


This initialization will cause any floating-point instruction to generate a device not available exception (#NM), inter- 
rupt 7. The software emulation will then take control to execute these instructions. This code is not required if an 
Intel 487 SX math coprocessor is present in the system. In that case, the typical initialization routine for the 
Intel486 SX microprocessor will be adequate. 


Also, when designing an Intel486 SX processor based system with an Intel 487 SX math coprocessor, timing loops 
should be independent of frequency and clocks per instruction. One way to attain this is to implement these loops 
in hardware and not in software (for example, BIOS). 


23.21 CONTROL REGISTERS 


The following sections identify the new control registers and control register flags and fields that were introduced 
to the 32-bit IA-32 in various processor families. See Figure 2-7 for the location of these flags and fields in the 
control registers. 
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The Pentium Ill processor introduced one new control flag in control register CR4: 
* OSXMMEXCPT (bit 10) — The OS will set this bit if it supports unmasked SIMD floating-point exceptions. 
The Pentium II processor introduced one new control flag in control register CR4: 


© OSFXSR (bit 9) — The OS supports saving and restoring the Pentium III processor state during context 
switches. 


The Pentium Pro processor introduced three new control flags in control register CR4: 


e PAE (bit 5) — Physical address extension. Enables paging mechanism to reference extended physical addresses 
when set; restricts physical addresses to 32 bits when clear (see also: Section 23.22.1.1, “Physical Memory 
Addressing Extension”). 


° PGE (bit 7) — Page global enable. Inhibits flushing of frequently-used or shared pages on CR3 writes (see also: 
Section 23.22.1.2, “Global Pages”). 


° PCE (bit 8) — Performance-monitoring counter enable. Enables execution of the RDPMC instruction at any 
protection level. 


The content of CR4 is OH following a hardware reset. 


Control register CR4 was introduced in the Pentium processor. This register contains flags that enable certain new 
extensions provided in the Pentium processor: 


¢ VME — Virtual-8086 mode extensions. Enables support for a virtual interrupt flag in virtual-8086 mode (see 
Section 21.3, “Interrupt and Exception Handling in Virtual-8086 Mode”). 


¢ PVI — Protected-mode virtual interrupts. Enables support for a virtual interrupt flag in protected mode (see 
Section 21.4, “Protected-Mode Virtual Interrupts”). 


¢ TSD — Time-stamp disable. Restricts the execution of the RDTSC instruction to procedures running at 
privileged level 0. 


¢ DE — Debugging extensions. Causes an undefined opcode (#UD) exception to be generated when debug 
registers DR4 and DRS are references for improved performance (see Section 23.23.3, ‘Debug Registers DR4 
and DR5"). 


° PSE — Page size extensions. Enables 4-MByte pages with 32-bit paging when set (see Section 4.3, “32-Bit 
Paging”). 


¢ MCE — Machine-check enable. Enables the machine-check exception, allowing exception handling for certain 
hardware error conditions (see Chapter 16, “Machine-Check Architecture”). 


The Intel486 processor introduced five new flags in control register CRO: 
¢ NE — Numeric error. Enables the normal mechanism for reporting floating-point numeric errors. 
¢ WP — Write protect. Write-protects read-only pages against supervisor-mode accesses. 


¢ AM — Alignment mask. Controls whether alignment checking is performed. Operates in conjunction with the AC 
(Alignment Check) flag. 


¢ NW — Not write-through. Enables write-throughs and cache invalidation cycles when clear and disables invali- 
dation cycles and write-throughs that hit in the cache when set. 


* CD — Cache disable. Enables the internal cache when clear and disables the cache when set. 
The Intel486 processor introduced two new flags in control register CR3: 


¢ PCD — Page-level cache disable. The state of this flag is driven on the PCD# pin during bus cycles that are not 
paged, such as interrupt acknowledge cycles, when paging is enabled. The PCD# pin is used to control caching 
in an external cache on a cycle-by-cycle basis. 


¢ PWT — Page-level write-through. The state of this flag is driven on the PWT# pin during bus cycles that are not 
paged, such as interrupt acknowledge cycles, when paging is enabled. The PWT# pin is used to control write 
through in an external cache on a cycle-by-cycle basis. 


23-18 Vol. 3B 


ARCHITECTURE COMPATIBILITY 


23.22 MEMORY MANAGEMENT FACILITIES 


The following sections describe the new memory management facilities available in the various IA-32 processors 
and some compatibility differences. 


23.22.1 New Memory Management Control Flags 


The Pentium Pro processor introduced three new memory management features: physical memory addressing 
extension, the global bit in page-table entries, and general support for larger page sizes. These features are only 
available when operating in protected mode. 


23.22.1.1 Physical Memory Addressing Extension 


The new PAE (physical address extension) flag in control register CR4, bit 5, may enable additional address lines 
on the processor, allowing extended physical addresses. This option can only be used when paging is enabled, 
using a new page-table mechanism provided to support the larger physical address range (see Section 4.1, “Paging 
Modes and Control Bits”). 


23.22.1.2 Global Pages 


The new PGE (page global enable) flag in control register CR4, bit 7, provides a mechanism for preventing 
frequently used pages from being flushed from the translation lookaside buffer (TLB). When this flag is set, 
frequently used pages (such as pages containing kernel procedures or common data tables) can be marked global 
by setting the global flag in a page-directory or page-table entry. 


On a task switch or a write to control register CR3 (which normally causes the TLBs to be flushed), the entries in 
the TLB marked global are not flushed. Marking pages global in this manner prevents unnecessary reloading of the 
TLB due to TLB misses on frequently used pages. See Section 4.10, “Caching Translation Information,” for a 
detailed description of this mechanism. 


23.22.1.3 Larger Page Sizes 


The P6 family processors support large page sizes. For 32-bit paging, this facility is enabled with the PSE (page size 
extension) flag in control register CR4, bit 4. When this flag is set, the processor supports either 4-KByte or 4- 
MByte page sizes. PAE paging and 4-level paging! support 2-MByte pages regardless of the value of CR4.PSE (see 
Section 4.4, “PAE Paging,” and Section 4.5, “4-Level Paging and 5-Level Paging”). See Chapter 4, “Paging,” for 
more information about large page sizes. 


23.22.2 CD and NW Cache Control Flags 


The CD and NW flags in control register CRO were introduced in the Intel486 processor. In the P6 family and 
Pentium processors, these flags are used to implement a writeback strategy for the data cache; in the Intel486 
processor, they implement a write-through strategy. See Table 12-5 for a comparison of these bits on the P6 family, 
Pentium, and Intel486 processors. For complete information on caching, see Chapter 12, “Memory Cache Control.” 


23.22.3 Descriptor Types and Contents 


Operating-system code that manages space in descriptor tables often contains an invalid value in the access-rights 
field of descriptor-table entries to identify unused entries. Access rights values of 80H and OOH remain invalid for 
the P6 family, Pentium, Intel486, Intel386, and Intel 286 processors. Other values that were invalid on the Intel 
286 processor may be valid on the 32-bit processors because uses for these bits have been defined. 


1. Earlier versions of this manual used the term “IA-32e paging” to identify 4-level paging. 
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23.22.4 Changes in Segment Descriptor Loads 


On the Intel386 processor, loading a segment descriptor always causes a locked read and write to set the accessed 
bit of the descriptor. On the P6 family, Pentium, and Intel486 processors, the locked read and write occur only if the 
bit is not already set. 


23.23 DEBUG FACILITIES 


The P6 family and Pentium processors include extensions to the Intel486 processor debugging support for break- 
points. To use the new breakpoint features, it is necessary to set the DE flag in control register CR4. 


23.23.1 Differences in Debug Register DR6 


It is not possible to write a 1 to reserved bit 12 in debug status register DR6 on the P6 family and Pentium proces- 
sors; however, it is possible to write a 1 in this bit on the Intel486 processor. See Table 10-1 for the different setting 
of this register following a power-up or hardware reset. 


23.23.2 Differences in Debug Register DR7 


The P6 family and Pentium processors determines the type of breakpoint access by the R/WO through R/W3 fields 
in debug control register DR7 as follows: 


00 Break on instruction execution only. 
01 Break on data writes only. 
10 Undefined if the DE flag in control register CR4 is cleared; break on I/O reads or writes but not instruction 


fetches if the DE flag in control register CR4 is set. 
11 Break on data reads or writes but not instruction fetches. 


On the P6 family and Pentium processors, reserved bits 11, 12, 14, and 15 are hard-wired to 0. On the Intel486 
processor, however, bit 12 can be set. See Table 10-1 for the different settings of this register following a power-up 
or hardware reset. 


23.23.3 Debug Registers DR4 and DR5 


Although the DR4 and DR5 registers are documented as reserved, previous generations of processors aliased refer- 
ences to these registers to debug registers DR6 and DR7, respectively. When debug extensions are not enabled 
(the DE flag in control register CR4 is cleared), the P6 family and Pentium processors remain compatible with 
existing software by allowing these aliased references. When debug extensions are enabled (the DE flag is set), 
attempts to reference registers DR4 or DRS will result in an invalid-opcode exception (#UD). 


23.24 RECOGNITION OF BREAKPOINTS 


For the Pentium processor, it is recommended that debuggers execute the LGDT instruction before returning to the 
program being debugged to ensure that breakpoints are detected. This operation does not need to be performed 
on the P6 family, Intel486, or Intel386 processors. 


The implementation of test registers on the Intel486 processor used for testing the cache and TLB has been rede- 
signed using MSRs on the P6 family and Pentium processors. (Note that MSRs used for this function are different 
on the P6 family and Pentium processors.) The MOV to and from test register instructions generate invalid-opcode 
exceptions (#UD) on the P6 family processors. 
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23.25 EXCEPTIONS AND/OR EXCEPTION CONDITIONS 


This section describes the new exceptions and exception conditions added to the 32-bit IA-32 processors and 
implementation differences in existing exception handling. See Chapter 6, “Interrupt and Exception Handling,” for 
a detailed description of the IA-32 exceptions. 


The Pentium Ill processor introduced new state with the XMM registers. Computations involving data in these regis- 
ters can produce exceptions. A new MXCSR control/status register is used to determine which exception or excep- 
tions have occurred. When an exception associated with the XMM registers occurs, an interrupt is generated. 


¢ SIMD floating-point exception (#XM, interrupt 19) — New exceptions associated with the SIMD floating-point 
registers and resulting computations. 


No new exceptions were added with the Pentium Pro and Pentium II processors. The set of available exceptions is 
the same as for the Pentium processor. However, the following exception condition was added to the IA-32 with the 
Pentium Pro processor: 


¢ Machine-check exception (#MC, interrupt 18) — New exception conditions. Many exception conditions have 
been added to the machine-check exception and a new architecture has been added for handling and reporting 
on hardware errors. See Chapter 16, “Machine-Check Architecture,” for a detailed description of the new 
conditions. 


The following exceptions and/or exception conditions were added to the IA-32 with the Pentium processor: 


¢ Machine-check exception (#MC, interrupt 18) — New exception. This exception reports parity and other 
hardware errors. It is a model-specific exception and may not be implemented or implemented differently in 
future processors. The MCE flag in control register CR4 enables the machine-check exception. When this bit is 
clear (which it is at reset), the processor inhibits generation of the machine-check exception. 


¢ General-protection exception (#GP, interrupt 13) — New exception condition added. An attempt to write a 1 to 
a reserved bit position of a special register causes a general-protection exception to be generated. 


° =Page-fault exception (#PF, interrupt 14) — New exception condition added. When a 1 is detected in any of the 
reserved bit positions of a page-table entry, page-directory entry, or page-directory pointer during address 
translation, a page-fault exception is generated. 


The following exception was added to the Intel486 processor: 


¢ = Alignment-check exception (#AC, interrupt 17) — New exception. Reports unaligned memory references when 
alignment checking is being performed. 


The following exceptions and/or exception conditions were added to the Intel386 processor: 
*  Divide-error exception (#DE, interrupt 0) 


— Change in exception handling. Divide-error exceptions on the Intel386 processors always leave the saved 
CS:IP value pointing to the instruction that failed. On the 8086 processor, the CS: IP value points to the next 
instruction. 


— Change in exception handling. The Intel386 processors can generate the largest negative number as a 
quotient for the IDIV instruction (80H and 8000H). The 8086 processor generates a divide-error exception 
instead. 


¢ Invalid-opcode exception (#UD, interrupt 6) — New exception condition added. Improper use of the LOCK 
instruction prefix can generate an invalid-opcode exception. 


° =Page-fault exception (#PF, interrupt 14) — New exception condition added. If paging is enabled in a 16-bit 
program, a page-fault exception can be generated as follows. Paging can be used in a system with 16-bit tasks 
if all tasks use the same page directory. Because there is no place in a 16-bit TSS to store the PDBR register, 
switching to a 16-bit task does not change the value of the PDBR register. Tasks ported from the Intel 286 
processor should be given 32-bit TSSs so they can make full use of paging. 


° General-protection exception (#GP, interrupt 13) — New exception condition added. The Intel386 processor 
sets a limit of 15 bytes on instruction length. The only way to violate this limit is by putting redundant prefixes 
before an instruction. A general-protection exception is generated if the limit on instruction length is violated. 
The 8086 processor has no instruction length limit. 
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23.25.1 Machine-Check Architecture 


The Pentium Pro processor introduced a new architecture to the IA-32 for handling and reporting on machine-check 
exceptions. This machine-check architecture (described in detail in Chapter 16, “Machine-Check Architecture”) 
greatly expands the ability of the processor to report on internal hardware errors. 


23.25.2 Priority of Exceptions 

The priority of exceptions are broken down into several major categories: 
Traps on the previous instruction 

External interrupts 

Faults on fetching the next instruction 


PN 


Faults in decoding the next instruction 
5. Faults on executing an instruction 


There are no changes in the priority of these major categories between the different processors, however, excep- 
tions within these categories are implementation dependent and may change from processor to processor. 


23.25.3 Exception Conditions of Legacy SIMD Instructions Operating on MMX Registers 


MMX instructions and a subset of SSE, SSE2, SSSE3 instructions operate on MMX registers. The exception condi- 
tions of these instructions are described in the following tables. 


Table 23-4. Exception Conditions for Legacy SIMD/MMxX Instructions with FP Exception and 16-Byte Alignment 


a=) 
8 |se 
—|8 |ouabl# 
. oO T oys| 2 i 
Exception 9|/ sa /ealy Cause of Exception 
“|e /fe] © 
SES 
X X X X | lf an unmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 0. 


If CRO.EM[bit 2] = 1. 
Invalid Opcode, If CR4.OSFXSRIbit 9] = 0. 


x< 
x< 
x< 
x< 


iota X X X X_ | If preceded by a LOCK prefix (FOH) 
X X X X_ | If any corresponding CPUID feature flag is ‘0’ 
#MF X X X X_ | If there is a pending X87 FPU exception 
#NM X | X X | X | lf CRO.TS[bit 3]=1 
X For an illegal address in the SS segment 


Stack, SS(O 
©) If a memory address referencing the SS segment is in a non-canonical form 


X X X X | Legacy SSE: Memory operand is not 16-byte aligned 


General Protec- X For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. 
tion, #GP(0) X_ | If the memory address is in a non-canonical form. 

X X If any part of the operand lies outside the effective address space from O to FFFFH 
#PF(fault-code) X X X | For a page fault 
#XM X X X X_| If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 1 
Applicable CVTPD2PI, CVTTPD2PI 
Instructions 
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Table 23-5. Exception Conditions for Legacy SIMD/MMxX Instructions with XMM and FP Exception 


a=) 

2/52 

— 8 75| £ 

= oO T ves; 2 . 
Exception o 3s loo] y Cause of Exception 

a Ss ijaelg 
E\|o§ 
> |av 

X X X X_ | If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPT[bit 10] = 0. 


Invalid Opcode, #UD 


If CRO.EM[bit 2] = 1 
If CR4.OSFXSRIbit 9] = 0. 


x< 
x< 
x< 
x< 


X X X X_ | If preceded by a LOCK prefix (FOH) 
X X X X_| If any corresponding CPUID feature flag is ‘0’ 
#MF X X X X | If there is a pending X87 FPU exception 
#NM X X X X | If CRO.TS[bit 3]=1 
X For an illegal address in the SS segment 
Stack, SS(0) 7 a ; 
X | lfamemory address referencing the SS segment is in a non-canonical form 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 
General Protection, ae : 
#GP(0) X_ | If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from 0 to 


FFFFH 


#PF(fault-code) 


Alignment Check 
#AC(0) 


X X X_ | For a page fault 


If alignment checking is enabled and an unaligned memory reference is made while 
the current privilege level is 3. 


SIMD Floating-point 
Exception, #XM 


X X X X_ | If an unmasked SIMD floating-point exception and CR4.0SXMMEXCPTIbit 10] = 1 


Applicable Instruc- 
tions 


CVTPI2PS, CVTPS2PI, CVTTPS2PI 
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Table 23-6. Exception Conditions for Legacy SIMD/MMX Instructions with XMM and without FP Exception 


tions 


a=) 
S |S 
= i 05| & 
e oO T vos; O i 
Exception a 3s lool] y Cause of Exception 
rar Ss ijaelg 
Eos 
> |av 
If CRO.EM[bit 2] = 1. 
. . . > If CR4.0SFXSR[bit 9] = 0. 
Invalid Opcode, #UD ["y "Tx | x | x | ifpreceded by a LOCK prefix (FOH) 
X X X X_ | If any corresponding CPUID feature flag is ‘0’ 
#MF! X X X X | If there is a pending X87 FPU exception 
#NM X X X X_ | If CRO.TS[bit 3]=1 
X For an illegal address in the SS segment 
Stack, SS(0) - — - 
X | Ifamemory address referencing the SS segment is in a non-canonical form 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
ments. 
pat Erote enon, X_ | If the memory address is in a non-canonical form. 
If any part of the operand lies outside the effective address space from O to 
X X 
FFFFH 
#PF(fault-code) X X X_ | For a page fault 
Alignment Check X X X If alignment checking is enabled and an unaligned memory reference is made 
#AC(0) while the current privilege level is 3. 
Applicable Instruc- CVTPI2PD 


NOTES: 


1. Applies to “CVTPIZPD xmm, mm” but not “CVTPI2PD xmm, m64". 
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Table 23-7. Exception Conditions for SIMD/MMX Instructions with Memory Reference 


a=) 
8 |se 
= S 7 O| # 
7 oO T vos; 2 i 
Exception o 3 ito] ¥} Cause of Exception 
“| 2 /8e]° 
5 |28 
X X X X | If CRO.EM[bit 2] = 1. 
Invalid Opcode, #UD X X X X_ | If preceded by a LOCK prefix (FOH) 
Xx X X X_ | If any corresponding CPUID feature flag is ‘0’ 
#MF X X X X | If there is a pending X87 FPU exception 
#NM X X X X | If CRO.TS[bit 3]=1 
X For an illegal address in the SS segment 
Stack, SS(0) - = : 
X | lfamemory address referencing the SS segment is in a non-canonical form 
X For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
General Protection, mene: 
#GP(0) X_| If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to FFFFH 
#PF(fault-code) X X_ | For a page fault 
Alignment Check If alignment checking is enabled and an unaligned memory reference is made while 
X X X oh : 
#AC(0) the current privilege level is 3. 


Applicable Instruc- 
tions 


PABSB, PABSD, PABSW, PACKSSWB, PACKSSDW, PACKUSWB, PADDB, PADDD, PADDQ, PADDW, PADDSB, 
PADDSW, PADDUSB, PADDUSW, PALIGNR, PAND, PANDN, PAVGB, PAVGW, PCMPEQB, PCMPEQD, PCMPEQW, 
PCMPGTB, PCMPGTD, PCMPGTW, PHADDD, PHADDW, PHADDSW, PHSUBD, PHSUBW, PHSUBSW, PINSRW, 
PMADDUBSW, PMADDWD, PMAXSW, PMAXUB, PMINSW, PMINUB, PMULHRSW, PMULHUW, PMULHW, PMULLW, 
PMULUDQ, PSADBW, PSHUFB, PSHUFW, PSIGNB PSIGND PSIGNW, PSLLW, PSLLD, PSLLQ, PSRAD, PSRAW, 
PSRLW, PSRLD, PSRLQ, PSUBB, PSUBD, PSUBQ, PSUBW, PSUBSB, PSUBSW, PSUBUSB, PSUBUSW, 
PUNPCKHBW, PUNPCKHWD, PUNPCKHDQ, PUNPCKLBW, PUNPCKLWD, PUNPCKLDQ, PXOR 
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Table 23-8. Exception Conditions for Legacy SIMD/MMxX Instructions without FP Exception 


a=) 
eS 
_ 2 75| & 
. oO T os] 2 i 
Exception 9\/sel/oa) y Cause of Exception 
a sian gf 
Eos 
> av 
If CRO.EM[bit 2] = 1. 
X X X X 
If ModR/M.mod # 11b! 
Invalid Opcode, #UD : 
P X X X X | If preceded by a LOCK prefix (FOH) 
X X X X_| If any corresponding CPUID feature flag is ‘0’ 
#MF X X X X | If there is a pending X87 FPU exception 
#NM X X X X | If CRO.TS[bit 3]=1 
X For an illegal address in the SS segment 
Stack, SS(0) - — : 
X | lfamemory address referencing the SS segment is in a non-canonical form 
For an illegal memory operand effective address in the CS, DS, ES, FS or GS seg- 
: ments. 
If the destination operand is in a non-writable segment.2 
#0P(0) If the DS, ES, FS, or GS register contains a NULL segment selector. 
X_ | If the memory address is in a non-canonical form. 
X X If any part of the operand lies outside the effective address space from O to FFFFH 
#PF(fault-code) X X X | For a page fault 
#AC(0) X X X If alignment checking is enabled and an unaligned memory reference is made while 
the current privilege level is 3. 
Applicable Instruc- MASKMOVQ, MOVNTQ, “MOVQ (mmreg)” 
tions 
NOTES: 


1. Applies to MASKMOVQ only. 


2. Applies to MASKMOVQ and MOVQ (mmreg) only. 


3. Applies to MASKMOVQ only. 
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Table 23-9. Exception Conditions for Legacy SIMD/MMxX Instructions without Memory Reference 


a=) 
8 |se 
— S 7 O| £ 
iz oO T veops| 2 i 
Exception a 3 if o] Cause of Exception 
“| 2/g#e¢ 
5 |28 
X X X X | If CRO.EM[bit 2] = 1. 
Invalid Opcode, #UD X X X X_ | If preceded by a LOCK prefix (FOH) 
X X X X_| If any corresponding CPUID feature flag is ‘0’ 
#MF X X X X | If there is a pending X87 FPU exception 
#NM X X_ | If CRO.TS[bit 3]=1 
Applicable Instruc- PEXTRW, PMOVMSKB 
tions 


23.26 INTERRUPTS 


The following differences in handling interrupts are found among the IA-32 
processors. 


23.26.1 Interrupt Propagation Delay 


External hardware interrupts may be recognized on different instruction boundaries on the P6 family, Pentium, 
Intel486, and Intel386 processors, due to the superscaler designs of the P6 family and Pentium processors. There- 
fore, the EIP pushed onto the stack when servicing an interrupt may be different for the P6 family, Pentium, 
Intel486, and Intel386 processors. 


23.26.2 NMI Interrupts 


After an NMI interrupt is recognized by the P6 family, Pentium, Intel486, Intel386, and Intel 286 processors, the 
NMI interrupt is masked until the first IRET instruction is executed, unlike the 8086 processor. 


23.26.3 IDT Limit 


The LIDT instruction can be used to set a limit on the size of the IDT. A double-fault exception (#DF) is generated 
if an interrupt or exception attempts to read a vector beyond the limit. Shutdown then occurs on the 32-bit IA-32 
processors if the double-fault handler vector is beyond the limit. (The 8086 processor does not have a shutdown 
mode nor a limit.) 


23.27 ADVANCED PROGRAMMABLE INTERRUPT CONTROLLER (APIC) 


The Advanced Programmable Interrupt Controller (APIC), referred to in this book as the local APIC, was intro- 
duced into the IA-32 processors with the Pentium processor (beginning with the 735/90 and 815/100 models) and 
is included in the Pentium 4, Intel Xeon, and P6 family processors. The features and functions of the local APIC are 
derived from the Intel 82489DX external APIC, which was used with the Intel486 and early Pentium processors. 
Additional refinements of the local APIC architecture were incorporated in the Pentium 4 and Intel Xeon processors. 
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23.27.1 Software Visible Differences Between the Local APIC and the 82489DX 


The following features in the local APIC features differ from those found in the 82489DX external APIC: 


¢ When the local APIC is disabled by clearing the APIC software enable/disable flag in the spurious-interrupt 
vector MSR, the state of its internal registers are unaffected, except that the mask bits in the LVT are all set to 
block local interrupts to the processor. Also, the local APIC ceases accepting IPIs except for INIT, SMI, NMI, and 
start-up IPIs. In the 82489DX, when the local unit is disabled, all the internal registers including the IRR, ISR, 
and TMR are cleared and the mask bits in the LVT are set. In this state, the 82489DxX local unit will accept only 
the reset deassert message. 


¢ Inthe local APIC, NMI and INIT (except for INIT deassert) are always treated as edge triggered interrupts, even 
if programmed otherwise. In the 82489Dx, these interrupts are always level triggered. 


¢ Inthe local APIC, IPIs generated through the ICR are always treated as edge triggered (except INIT Deassert). 
In the 82489DX, the ICR can be used to generate either edge or level triggered IPIs. 


¢ In the local APIC, the logical destination register supports 8 bits; in the 82489DxX, it supports 32 bits. 
¢ In the local APIC, the APIC ID register is 4 bits wide; in the 82489Dx, it is 8 bits wide. 


¢ The remote read delivery mode provided in the 82489DX and local APIC for Pentium processors is not 
supported in the local APIC in the Pentium 4, Intel Xeon, and P6 family processors. 


° For the 82489Dx, in the lowest priority delivery mode, all the target local APICs specified by the destination 
field participate in the lowest priority arbitration. For the local APIC, only those local APICs which have free 
interrupt slots will participate in the lowest priority arbitration. 


23.27.2 New Features Incorporated in the Local APIC for the P6 Family and Pentium 
Processors 


The local APIC in the Pentium and P6 family processors have the following new features not found in the 82489DX 
external APIC. 


* Cluster addressing is supported in logical destination mode. 

® Focus processor checking can be enabled/disabled. 

¢ Interrupt input signal polarity can be programmed for the LINTO and LINT1 pins. 
¢ An SMI IPI is supported through the ICR and I/O redirection table. 

e Anerror status register is incorporated into the LVT to log and report APIC errors. 


In the P6 family processors, the local APIC incorporates an additional LVT register to handle performance moni- 
toring counter interrupts. 


23.27.3 New Features Incorporated in the Local APIC of the Pentium 4 and Intel Xeon 
Processors 


The local APIC in the Pentium 4 and Intel Xeon processors has the following new features not found in the P6 family 
and Pentium processors and in the 82489Dx. 


¢ The local APIC ID is extended to 8 bits. 

¢ Anthermal sensor register is incorporated into the LVT to handle thermal sensor interrupts. 

° The the ability to deliver lowest-priority interrupts to a focus processor is no longer supported. 
e =6The flat cluster logical destination mode is not supported. 


23.28 TASK SWITCHING AND TSS 


This section identifies the implementation differences of task switching, additions to the TSS and the handling of 
TSSs and TSS segment selectors. 
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23.28.1 P6 Family and Pentium Processor TSS 


When the virtual mode extensions are enabled (by setting the VME flag in control register CR4), the TSS in the P6 
family and Pentium processors contain an interrupt redirection bit map, which is used in virtual-8086 mode to redi- 
rect interrupts back to an 8086 program. 


23.28.2 TSS Selector Writes 


During task state saves, the Intel486 processor writes 2-byte segment selectors into a 32-bit TSS, leaving the 
upper 16 bits undefined. For performance reasons, the P6 family and Pentium processors write 4-byte segment 
selectors into the TSS, with the upper 2 bytes being 0. For compatibility reasons, code should not depend on the 
value of the upper 16 bits of the selector in the TSS. 


23.28.3 Order of Reads/Writes to the TSS 


The order of reads and writes into the TSS is processor dependent. The P6 family and Pentium processors may 
generate different page-fault addresses in control register CR2 in the same TSS area than the Intel486 and 
Intel386 processors, if a TSS crosses a page boundary (which is not recommended). 


23.28.4 Using A 16-Bit TSS with 32-Bit Constructs 


Task switches using 16-bit TSSs should be used only for pure 16-bit code. Any new code written using 32-bit 
constructs (operands, addressing, or the upper word of the EFLAGS register) should use only 32-bit TSSs. This is 
due to the fact that the 32-bit processors do not save the upper 16 bits of EFLAGS to a 16-bit TSS. A task switch 
back to a 16-bit task that was executing in virtual mode will never re-enable the virtual mode, as this flag was not 
saved in the upper half of the EFLAGS value in the TSS. Therefore, it is strongly recommended that any code using 
32-bit constructs use a 32-bit TSS to ensure correct behavior in a multitasking environment. 


23.28.5 Differences in 1/O Map Base Addresses 


The Intel486 processor considers the TSS segment to be a 16-bit segment and wraps around the 64K boundary. 
Any I/O accesses check for permission to access this I/O address at the I/O base address plus the I/O offset. If the 
I/O map base address exceeds the specified limit of ODFFFH, an I/O access will wrap around and obtain the permis- 
sion for the I/O address at an incorrect location within the TSS. A TSS limit violation does not occur in this situation 
on the Intel486 processor. However, the P6 family and Pentium processors consider the TSS to be a 32-bit segment 
and a limit violation occurs when the I/O base address plus the I/O offset is greater than the TSS limit. By following 
the recommended specification for the I/O base address to be less than ODFFFH, the Intel486 processor will not 
wrap around and access incorrect locations within the TSS for I/O port validation and the P6 family and Pentium 
processors will not experience general-protection exceptions (#GP). Figure 23-1 demonstrates the different areas 
accessed by the Intel486 and the P6 family and Pentium processors. 
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Intel486 Processor P6 family and Pentium Processors 


FFFFH + 10H = Outside Segment 
for I/O Validation 


/O Map /O0 Map 
Base Addres FFFFH Base Addres FFFFH 


—3> FFFFH + 10H = FH 
for I/O Validation 


OH OH 
/O access at port 10H checks I/O access at port 10H checks 
bitmap at I/O map base address bitmap at I/O address FFFFH + 10H, 
FFFFH + 10H = offset 10H. which exceeds segment limit. 
Offset FH from beginning of Wrap around does not occur, 
TSS segment results because general-protection exception (#GP) 
wraparound occurs. occurs. 


Figure 23-1. I/O Map Base Address Differences 


23.29 CACHE MANAGEMENT 


The P6 family processors include two levels of internal caches: Li (level 1) and L2 (level 2). The L1 cache is divided 
into an instruction cache and a data cache; the L2 cache is a general-purpose cache. See Section 12.1, “Internal 
Caches, TLBs, and Buffers,” for a description of these caches. (Note that although the Pentium II processor L2 
cache is physically located on a separate chip in the cassette, it is considered an internal cache.) 


The Pentium processor includes separate level 1 instruction and data caches. The data cache supports a writeback 
(or alternatively write-through, on a line by line basis) policy for memory updates. 


The Intel486 processor includes a single level 1 cache for both instructions and data. 


The meaning of the CD and NW flags in control register CRO have been redefined for the P6 family and Pentium 
processors. For these processors, the recommended value (O0OB) enables writeback for the data cache of the 
Pentium processor and for the Li data cache and L2 cache of the P6 family processors. In the Intel486 processor, 
setting these flags to (00B) enables write-through for the cache. 


External system hardware can force the Pentium processor to disable caching or to use the write-through cache 
policy should that be required. In the P6 family processors, the MTRRs can be used to override the CD and NW flags 
(see Table 12-6). 


The P6 family and Pentium processors support page-level cache management in the same manner as the Intel486 
processor by using the PCD and PWT flags in control register CR3, the page-directory entries, and the page-table 
entries. The Intel486 processor, however, is not affected by the state of the PWT flag since the internal cache of the 
Intel486 processor is a write-through cache. 


23.29.1 Self-Modifying Code with Cache Enabled 


On the Intel486 processor, a write to an instruction in the cache will modify it in both the cache and memory. If the 
instruction was prefetched before the write, however, the old version of the instruction could be the one executed. 
To prevent this problem, it is necessary to flush the instruction prefetch unit of the Intel486 processor by coding a 
jump instruction immediately after any write that modifies an instruction. The P6 family and Pentium processors, 
however, check whether a write may modify an instruction that has been prefetched for execution. This check is 
based on the linear address of the instruction. If the linear address of an instruction is found to be present in the 
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prefetch queue, the P6 family and Pentium processors flush the prefetch queue, eliminating the need to code a 
jump instruction after any writes that modify an instruction. 


Because the linear address of the write is checked against the linear address of the instructions that have been 
prefetched, special care must be taken for self-modifying code to work correctly when the physical addresses of the 
instruction and the written data are the same, but the linear addresses differ. In such cases, it is necessary to 
execute a serializing operation to flush the prefetch queue after the write and before executing the modified 
instruction. See Section 9.3, “Serializing Instructions,” for more information on serializing instructions. 


NOTE 


The check on linear addresses described above is not in practice a concern for compatibility. Appli- 
cations that include self-modifying code use the same linear address for modifying and fetching the 
instruction. System software, such as a debugger, that might possibly modify an instruction using 
a different linear address than that used to fetch the instruction must execute a serializing 
operation, such as IRET, before the modified instruction is executed. 


23.29.2 Disabling the L3 Cache 


A unified third-level (L3) cache in processors based on Intel NetBurst microarchitecture (see Section 12.1, 
“Internal Caches, TLBs, and Buffers”) provides the third-level cache disable flag, bit 6 of the IA32_MISC_ENABLE 
MSR. The third-level cache disable flag allows the L3 cache to be disabled and enabled, independently of the L1 and 
L2 caches (see Section 12.5.4, “Disabling and Enabling the L3 Cache”). The third-level cache disable flag applies 
only to processors based on Intel NetBurst microarchitecture. Processors with L3 and based on other microarchi- 
tectures do not support the third-level cache disable flag. 


23.30 PAGING 


This section identifies enhancements made to the paging mechanism and implementation differences in the paging 
mechanism for various IA-32 processors. 


23.30.1 Large Pages 


The Pentium processor extended the memory management/paging facilities of the IA-32 to allow large (4 MBytes) 
pages sizes (see Section 4.3, “32-Bit Paging”). The first P6 family processor (the Pentium Pro processor) added a 
2 MByte page size to the IA-32 in conjunction with the physical address extension (PAE) feature (see Section 4.4, 
“PAE Paging”). 


The availability of large pages with 32-bit paging on any IA-32 processor can be determined via feature bit 3 (PSE) 
of register EDX after the CPUID instruction has been execution with an argument of 1. (Large pages are always 
available with PAE paging and 4-level paging.) Intel processors that do not support the CPUID instruction support 
only 32-bit paging and do not support page size enhancements. (See “CPUID—CPU Identification” in Chapter 3, 
“Instruction Set Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
2A, for more information on the CPUID instruction.) 


23.30.2 PCD and PWT Flags 


The PCD and PWT flags were introduced to the IA-32 in the Intel486 processor to control the caching of pages: 
¢ PCD (page-level cache disable) flag—Controls caching on a page-by-page basis. 


¢ PWT (page-level write-through) flag—Controls the write-through/writeback caching policy on a page-by-page 
basis. Since the internal cache of the Intel486 processor is a write-through cache, it is not affected by the state 
of the PWT flag. 
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23.30.3 Enabling and Disabling Paging 


Paging is enabled and disabled by loading a value into control register CRO that modifies the PG flag. For backward 
and forward compatibility with all IA-32 processors, Intel recommends that the following operations be performed 
when enabling or disabling paging: 


1. Execute a MOV CRO, REG instruction to either set (enable paging) or clear (disable paging) the PG flag. 
2. Execute a near JMP instruction. 


The sequence bounded by the MOV and JMP instructions should be identity mapped (that is, the instructions should 
reside on a page whose linear and physical addresses are identical). 


For the P6 family processors, the MOV CRO, REG instruction is serializing, so the jump operation is not required. 
However, for backwards compatibility, the JMP instruction should still be included. 


23.31 STACK OPERATIONS AND SUPERVISOR SOFTWARE 


This section identifies the differences in the stack mechanism for the various IA-32 processors. 


23.31.1 Selector Pushes and Pops 


When pushing a segment selector onto the stack, the Pentium 4, Intel Xeon, P6 family, and Intel486 processors 
decrement the ESP register by the operand size and then write 2 bytes. If the operand size is 32-bits, the upper two 
bytes of the write are not modified. The Pentium processor decrements the ESP register by the operand size and 
determines the size of the write by the operand size. If the operand size is 32-bits, the upper two bytes are written 
as Os. 


When popping a segment selector from the stack, the Pentium 4, Intel Xeon, P6 family, and Intel486 processors 
read 2 bytes and increment the ESP register by the operand size of the instruction. The Pentium processor deter- 
mines the size of the read from the operand size and increments the ESP register by the operand size. 


It is possible to align a 32-bit selector push or pop such that the operation generates an exception on a Pentium 
processor and not on an Pentium 4, Intel Xeon, P6 family, or Intel486 processor. This could occur if the third and/or 
fourth byte of the operation lies beyond the limit of the segment or if the third and/or fourth byte of the operation 
is locate on a non-present or inaccessible page. 


For a POP-to-memory instruction that meets the following conditions: 
¢ The stack segment size is 16-bit. 
e Any 32-bit addressing form with the SIB byte specifying ESP as the base register. 


¢ The initial stack pointer is FFFCH (32-bit operand) or FFFEH (16-bit operand) and will wrap around to OH as a 
result of the POP operation. 


The result of the memory write is implementation-specific. For example, in P6 family processors, the result of the 
memory write is SS:0H plus any scaled index and displacement. In Pentium processors, the result of the memory 
write may be either a stack fault (real mode or protected mode with stack segment size of 64 KByte), or write to 

SS:10000H plus any scaled index and displacement (protected mode and stack segment size exceeds 64 KByte). 


23.31.2 Error Code Pushes 


The Intel486 processor implements the error code pushed on the stack as a 16-bit value. When pushed onto a 32- 
bit stack, the Intel486 processor only pushes 2 bytes and updates ESP by 4. The P6 family and Pentium processors’ 
error code is a full 32 bits with the upper 16 bits set to zero. The P6 family and Pentium processors, therefore, push 
4 bytes and update ESP by 4. Any code that relies on the state of the upper 16 bits may produce inconsistent 
results. 


23-32 Vol. 3B 


ARCHITECTURE COMPATIBILITY 


23.31.3 Fault Handling Effects on the Stack 


During the handling of certain instructions, such as CALL and PUSHA, faults may occur in different sequences for 
the different processors. For example, during far calls, the Intel486 processor pushes the old CS and EIP before a 
possible branch fault is resolved. A branch fault is a fault from a branch instruction occurring from a segment limit 
or access rights violation. If a branch fault is taken, the Intel486 and P6 family processors will have corrupted 
memory below the stack pointer. However, the ESP register is backed up to make the instruction restartable. The 
P6 family processors issue the branch before the pushes. Therefore, if a branch fault does occur, these processors 
do not corrupt memory below the stack pointer. This implementation difference, however, does not constitute a 
compatibility problem, as only values at or above the stack pointer are considered to be valid. Other operations 
that encounter faults may also corrupt memory below the stack pointer and this behavior may vary on different 
implementations. 


23.31.4 Interlevel RET/IRET From a 16-Bit Interrupt or Call Gate 


If a call or interrupt is made from a 32-bit stack environment through a 16-bit gate, only 16 bits of the old ESP can 
be pushed onto the stack. On the subsequent RET/IRET, the 16-bit ESP is popped but the full 32-bit ESP is updated 
since control is being resumed in a 32-bit stack environment. The Intel486 processor writes the SS selector into the 
upper 16 bits of ESP. The P6 family and Pentium processors write zeros into the upper 16 bits. 


23.32 MIXING 16- AND 32-BIT SEGMENTS 


The features of the 16-bit Intel 286 processor are an object-code compatible subset of those of the 32-bit IA-32 
processors. The D (default operation size) flag in segment descriptors indicates whether the processor treats a 
code or data segment as a 16-bit or 32-bit segment; the B (default stack size) flag in segment descriptors indicates 
whether the processor treats a stack segment as a 16-bit or 32-bit segment. 


The segment descriptors used by the Intel 286 processor are supported by the 32-bit IA-32 processors if the Intel- 
reserved word (highest word) of the descriptor is clear. On the 32-bit IA-32 processors, this word includes the 
upper bits of the base address and the segment limit. 


The segment descriptors for data segments, code segments, local descriptor tables (there are no descriptors for 
global descriptor tables), and task gates are the same for the 16- and 32-bit processors. Other 16-bit descriptors 
(TSS segment, call gate, interrupt gate, and trap gate) are supported by the 32-bit processors. 


The 32-bit processors also have descriptors for TSS segments, call gates, interrupt gates, and trap gates that 
support the 32-bit architecture. Both kinds of descriptors can be used in the same system. 


For those segment descriptors common to both 16- and 32-bit processors, clear bits in the reserved word cause the 
32-bit processors to interpret these descriptors exactly as an Intel 286 processor does, that is: 


¢ Base Address — The upper 8 bits of the 32-bit base address are clear, which limits base addresses to 24 bits. 
¢ Limit — The upper 4 bits of the limit field are clear, restricting the value of the limit field to 64 KBytes. 


°® Granularity bit — The G (granularity) flag is clear, indicating the value of the 16-bit limit is interpreted in units 
of 1 byte. 


° Big bit — In a data-segment descriptor, the B flag is clear in the segment descriptor used by the 32-bit 
processors, indicating the segment is no larger than 64 KBytes. 


° Default bit — In a code-segment descriptor, the D flag is clear, indicating 16-bit addressing and operands are 
the default. In a stack-segment descriptor, the D flag is clear, indicating use of the SP register (instead of the 
ESP register) and a 64-KByte maximum segment limit. 


For information on mixing 16- and 32-bit code in applications, see Chapter 22, “Mixing 16-Bit and 32-Bit Code.” 


23.33 SEGMENT AND ADDRESS WRAPAROUND 


This section discusses differences in segment and address wraparound between the P6 family, Pentium, Intel486, 
Intel386, Intel 286, and 8086 processors. 
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23.33.1 Segment Wraparound 


On the 8086 processor, an attempt to access a memory operand that crosses offset 65,535 or OFFFFH or offset 0 
(for example, moving a word to offset 65,535 or pushing a word when the stack pointer is set to 1) causes the 
offset to wrap around modulo 65,536 or 010000H. With the Intel 286 processor, any base and offset combination 
that addresses beyond 16 MBytes wraps around to the 1 MByte of the address space. The P6 family, Pentium, 
Intel486, and Intel386 processors in real-address mode generate an exception in these cases: 


¢ A general-protection exception (#GP) if the segment is a data segment (that is, if the CS, DS, ES, FS, or GS 
register is being used to address the segment). 


e A stack-fault exception (#SS) if the segment is a stack segment (that is, if the SS register is being used). 


An exception to this behavior occurs when a stack access is data aligned, and the stack pointer is pointing to the 
last aligned piece of data that size at the top of the stack (ESP is FFFFFFFCH). When this data is popped, no 
segment limit violation occurs and the stack pointer will wrap around to 0. 


The address space of the P6 family, Pentium, and Intel486 processors may wraparound at 1 MByte in real-address 
mode. An external A20M# pin forces wraparound if enabled. On Intel 8086 processors, it is possible to specify 
addresses greater than 1 MByte. For example, with a selector value FFFFH and an offset of FFFFH, the effective 
address would be 10FFEFH (1 MByte plus 65519 bytes). The 8086 processor, which can form addresses up to 20 
bits long, truncates the uppermost bit, which “wraps” this address to FFEFH. However, the P6 family, Pentium, and 
Intel486 processors do not truncate this bit if AZOM# is not enabled. 


If a stack operation wraps around the address limit, shutdown occurs. (The 8086 processor does not have a shut- 
down mode or a limit.) 


The behavior when executing near the limit of a 4-GByte selector (limit = FFFFFFFFH) is different between the 
Pentium Pro and the Pentium 4 family of processors. On the Pentium Pro, instructions which cross the limit -- for 
example, a two byte instruction such as INC EAX that is encoded as FFH COH starting exactly at the limit faults for 
a segment violation (a one byte instruction at FFFFFFFFH does not cause an exception). Using the Pentium 4 micro- 
processor family, neither of these situations causes a fault. 


Segment wraparound and the functionality of A20M# is used primarily by older operating systems and not used by 
modern operating systems. On newer Intel 64 processors, AZOM# may be absent. 


23.34 STORE BUFFERS AND MEMORY ORDERING 


The Pentium 4, Intel Xeon, and P6 family processors provide a store buffer for temporary storage of writes (stores) 
to memory (see Section 12.10, “Store Buffer”). Writes stored in the store buffer(s) are always written to memory 
in program order, with the exception of “fast string” store operations (see Section 9.2.4, “Fast-String Operation and 
Out-of-Order Stores”). 


The Pentium processor has two store buffers, one corresponding to each of the pipelines. Writes in these buffers 
are always written to memory in the order they were generated by the processor core. 


It should be noted that only memory writes are buffered and I/O writes are not. The Pentium 4, Intel Xeon, P6 
family, Pentium, and Intel486 processors do not synchronize the completion of memory writes on the bus and 
instruction execution after a write. An I/O, locked, or serializing instruction needs to be executed to synchronize 
writes with the next instruction (see Section 9.3, “Serializing Instructions”). 


The Pentium 4, Intel Xeon, and P6 family processors use processor ordering to maintain consistency in the order 
that data is read (loaded) and written (stored) in a program and the order the processor actually carries out the 
reads and writes. With this type of ordering, reads can be carried out speculatively and in any order, reads can pass 
buffered writes, and writes to memory are always carried out in program order. (See Section 9.2, “Memory 
Ordering,” for more information about processor ordering.) The Pentium III processor introduced a new instruction 
to serialize writes and make them globally visible. Memory ordering issues can arise between a producer and a 
consumer of data. The SFENCE instruction provides a performance-efficient way of ensuring ordering between 
routines that produce weakly-ordered results and routines that consume this data. 


No re-ordering of reads occurs on the Pentium processor, except under the condition noted in Section 9.2.1, 
“Memory Ordering in the Intel® Pentium® and Intel486™ Processors,” and in the following paragraph describing 
the Intel486 processor. 
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Specifically, the store buffers are flushed before the IN instruction is executed. No reads (as a result of cache miss) 
are reordered around previously generated writes sitting in the store buffers. The implication of this is that the 
store buffers will be flushed or emptied before a subsequent bus cycle is run on the external bus. 


On both the Intel486 and Pentium processors, under certain conditions, a memory read will go onto the external 
bus before the pending memory writes in the buffer even though the writes occurred earlier in the program execu- 
tion. A memory read will only be reordered in front of all writes pending in the buffers if all writes pending in the 
buffers are cache hits and the read is a cache miss. Under these conditions, the Intel486 and Pentium processors 
will not read from an external memory location that needs to be updated by one of the pending writes. 


During a locked bus cycle, the Intel486 processor will always access external memory, it will never look for the 
location in the on-chip cache. All data pending in the Intel486 processor's store buffers will be written to memory 
before a locked cycle is allowed to proceed to the external bus. Thus, the locked bus cycle can be used for elimi- 
nating the possibility of reordering read cycles on the Intel486 processor. The Pentium processor does check its 
cache on a read-modify-write access and, if the cache line has been modified, writes the contents back to memory 
before locking the bus. The P6 family processors write to their cache on a read-modify-write operation (if the 
access does not split across a cache line) and does not write back to system memory. If the access does split across 
a cache line, it locks the bus and accesses system memory. 


I/O reads are never reordered in front of buffered memory writes on an IA-32 processor. This ensures an update of 
all memory locations before reading the status from an I/O device. 


23.35 BUS LOCKING 


The Intel 286 processor performs the bus locking differently than the Intel P6 family, Pentium, Intel486, and 
Intel386 processors. Programs that use forms of memory locking specific to the Intel 286 processor may not run 
properly when run on later processors. 


A locked instruction is guaranteed to lock only the area of memory defined by the destination operand, but may 
lock a larger memory area. For example, typical 8086 and Intel 286 configurations lock the entire physical memory 
space. Programmers should not depend on this. 


On the Intel 286 processor, the LOCK prefix is sensitive to IOPL. If the CPL is greater than the IOPL, a general- 
protection exception (#GP) is generated. On the Intel386 DX, Intel486, and Pentium, and P6 family processors, no 
check against IOPL is performed. 


The Pentium processor automatically asserts the LOCK# signal when acknowledging external interrupts. After 
signaling an interrupt request, an external interrupt controller may use the data bus to send the interrupt vector to 
the processor. After receiving the interrupt request signal, the processor asserts LOCK# to ensure that no other 
data appears on the data bus until the interrupt vector is received. This bus locking does not occur on the P6 family 
processors. 


23.36 BUS HOLD 


Unlike the 8086 and Intel 286 processors, but like the Intel386 and Intel486 processors, the P6 family and Pentium 
processors respond to requests for control of the bus from other potential bus masters, such as DMA controllers, 
between transfers of parts of an unaligned operand, such as two words which form a doubleword. Unlike the 
Intel386 processor, the P6 family, Pentium, and Intel486 processors respond to bus hold during reset initialization. 


23.37  MODEL-SPECIFIC EXTENSIONS TO THE IA-32 


Certain extensions to the IA-32 are specific to a processor or family of IA-32 processors and may not be imple- 
mented or implemented in the same way in future processors. The following sections describe these model-specific 
extensions. The CPUID instruction indicates the availability of some of the model-specific features. 
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23.37.1 Model-Specific Registers 


The Pentium processor introduced a set of model-specific registers (MSRs) for use in controlling hardware functions 
and performance monitoring. To access these MSRs, two new instructions were added to the IA-32 architecture: 
read MSR (RDMSR) and write MSR (WRMSR). The MSRs in the Pentium processor are not guaranteed to be dupli- 
cated or provided in the next generation IA-32 processors. 


The P6 family processors greatly increased the number of MSRs available to software. See Chapter 2, “Model- 
Specific Registers (MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for a 
complete list of the available MSRs. The new registers control the debug extensions, the performance counters, the 
machine-check exception capability, the machine-check architecture, and the MTRRs. These registers are acces- 
sible using the RDMSR and WRMSR instructions. Specific information on some of these new MSRs is provided in the 
following sections. As with the Pentium processor MSR, the P6 family processor MSRs are not guaranteed to be 
duplicated or provided in the next generation IA-32 processors. 


23.37.2 RDMSR and WRMSR Instructions 


The RDMSR (read model-specific register) and WRMSR (write model-specific register) instructions recognize a 
much larger number of model-specific registers in the P6 family processors. (See “RDMSR—Read from Model 
Specific Register” and “WRMSR—Write to Model Specific Register” in the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, for more information.) 


23.37.3| Memory Type Range Registers 


Memory type range registers (MTRRs) are a new feature introduced into the IA-32 in the Pentium Pro processor. 
MTRRs allow the processor to optimize memory operations for different types of memory, such as RAM, ROM, frame 
buffer memory, and memory-mapped I/O. 


MTRRs are MSRs that contain an internal map of how physical address ranges are mapped to various types of 
memory. The processor uses this internal memory map to determine the cacheability of various physical memory 
locations and the optimal method of accessing memory locations. For example, if a memory location is specified in 
an MTRR as write-through memory, the processor handles accesses to this location as follows. It reads data from 
that location in lines and caches the read data or maps all writes to that location to the bus and updates the cache 
to maintain cache coherency. In mapping the physical address space with MTRRs, the processor recognizes five 
types of memory: uncacheable (UC), uncacheable, speculatable, write-combining (WC), write-through (WT), 
write-protected (WP), and writeback (WB). 


Earlier IA-32 processors (such as the Intel486 and Pentium processors) used the KEN# (cache enable) pin and 
external logic to maintain an external memory map and signal cacheable accesses to the processor. The MTRR 
mechanism simplifies hardware designs by eliminating the KEN# pin and the external logic required to drive it. 


See Chapter 10, “Processor Management and Initialization,” and Chapter 2, “Model-Specific Registers (MSRs),” in 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4, for more information on the MTRRs. 


23.37.4 Machine-Check Exception and Architecture 


The Pentium processor introduced a new exception called the machine-check exception (#MC, interrupt 18). This 
exception is used to detect hardware-related errors, such as a parity error on a read cycle. 


The P6 family processors extend the types of errors that can be detected and that generate a machine-check 
exception. It also provides a new machine-check architecture for recording information about a machine-check 
error and provides extended recovery capability. 


The machine-check architecture provides several banks of reporting registers for recording machine-check errors. 
Each bank of registers is associated with a specific hardware unit in the processor. The primary focus of the 
machine checks is on bus and interconnect operations; however, checks are also made of translation lookaside 
buffer (TLB) and cache operations. 


23-36 Vol. 3B 


ARCHITECTURE COMPATIBILITY 


The machine-check architecture can correct some errors automatically and allow for reliable restart of instruction 
execution. It also collects sufficient information for software to use in correcting other machine errors not corrected 
by hardware. 


See Chapter 16, “Machine-Check Architecture,” for more information on the machine-check exception and the 
machine-check architecture. 


23.37.5 Performance-Monitoring Counters 


The P6 family and Pentium processors provide two performance-monitoring counters for use in monitoring internal 
hardware operations. The number of performance monitoring counters and associated programming interfaces 
may be implementation specific for Pentium 4 processors, Pentium M processors. Later processors may have 
implemented these as part of an architectural performance monitoring feature. The architectural and non-architec- 
tural performance monitoring interfaces for different processor families are described in Chapter 20, “Performance 
Monitoring.” https://perfmon-events.intel.com/ lists all the events that can be counted for architectural perfor- 
mance monitoring events and non-architectural events. The counters are set up, started, and stopped using two 
MSRs and the RDMSR and WRMSR instructions. For the P6 family processors, the current count for a particular 
counter can be read using the new RDPMC instruction. 


The performance-monitoring counters are useful for debugging programs, optimizing code, diagnosing system fail- 
ures, or refining hardware designs. See Chapter 20, “Performance Monitoring,” for more information on these 
counters. 


23.38 TWO WAYS TO RUN INTEL 286 PROCESSOR TASKS 


When porting 16-bit programs to run on 32-bit IA-32 processors, there are two approaches to consider: 


° Porting an entire 16-bit software system to a 32-bit processor, complete with the old operating system, loader, 
and system builder. Here, all tasks will have 16-bit TSSs. The 32-bit processor is being used as if it were a faster 
version of the 16-bit processor. 


¢ Porting selected 16-bit applications to run in a 32-bit processor environment with a 32-bit operating system, 
loader, and system builder. Here, the TSSs used to represent 286 tasks should be changed to 32-bit TSSs. It is 
possible to mix 16 and 32-bit TSSs, but the benefits are small and the problems are great. All tasks in a 32-bit 
software system should have 32-bit TSSs. It is not necessary to change the 16-bit object modules themselves; 
TSSs are usually constructed by the operating system, by the loader, or by the system builder. See Chapter 22, 
“Mixing 16-Bit and 32-Bit Code,” for more detailed information about mixing 16-bit and 32-bit code. 


Because the 32-bit processors use the contents of the reserved word of 16-bit segment descriptors, 16-bit 
programs that place values in this word may not run correctly on the 32-bit processors. 


23.39 INITIAL STATE OF PENTIUM, PENTIUM PRO AND PENTIUM 4 PROCESSORS 


Table 23-10 shows the state of the flags and other registers following power-up for the Pentium, Pentium Pro and 
Pentium 4 processors. The state of control register CRO is 60000010H (see Figure 10-1 “Contents of CRO Register 
after Reset” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). This places the 
processor in real-address mode with paging disabled. 


Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors 


Register Pentium 4 Processor Pentium Pro Processor Pentium Processor 
EFLAGS! 00000002H 00000002H 00000002H 
EIP OOOOFFFOH OOOOFFFOH OOOOFFFOH 
CRO 60000010H? 60000010H* 60000010H? 
CR2, CR3, CR4 OO000000H O00000000H O0000000H 
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Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors 


Register 


Pentium 4 Processor 


Pentium Pro Processor 


Pentium Processor 


CS 


Selector = FOOOH 

Base = FFFFOOOOH 

Limit = FFFFH 

AR = Present, R/W, Accessed 


Selector = FOOOH 

Base = FFFFOOOOH 

Limit = FFFFH 

AR = Present, R/W, Accessed 


Selector = FOOOH 

Base = FFFFOOOOH 

Limit = FFFFH 

AR = Present, R/W, Accessed 


SS, DS, ES, FS, GS 


Selector = OOOOH 
Base = QOOO00000H 


Selector = OOOOH 
Base = OOOO00000H 


Selector = OOOOH 
Base = OOOO00000H 


Limit = FFFFH Limit = FFFFH Limit = FFFFH 

AR = Present, R/W, Accessed AR = Present, R/W, Accessed AR = Present, R/W, Accessed 
EDX OOOO0FxxH 000n06xxH? 000005xxH 
EAX o* o* o* 
EBX, ECX, ESI, EDI, EBP, | OOOOO000H O0000000H OO000000H 


ESP 


STO through ST7° 


Pwr up or Reset: +0.0 
FINIT/FNINIT: Unchanged 


Pwr up or Reset: +0.0 
FINIT/FNINIT: Unchanged 


Pwr up or Reset: +0.0 
FINIT/FNINIT: Unchanged 


x87 FPU Control 
Word? 


x87 FPU Status Word? 


Pwr up or Reset: 0040H 
FINIT/FNINIT: 037FH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


Pwr up or Reset: 0040H 
FINIT/FNINIT: 037FH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


Pwr up or Reset: 0040H 
FINIT/FNINIT: 037FH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


x87 FPU Tag Word? 


x87 FPU Data 
Operand and CS Seg. 
Selectors? 


Pwr up or Reset: 5555H 
FINIT/FNINIT: FFFFH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


Pwr up or Reset: 5555H 
FINIT/FNINIT: FFFFH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


Pwr up or Reset: 5555H 
FINIT/FNINIT: FFFFH 


Pwr up or Reset: OOOOH 
FINIT/FNINIT: OOOOH 


x87 FPU Data 
Operand and Inst. 
Pointers? 


Pwr up or Reset: 
OO000000H 
FINIT/FNINIT: OOOOOOOOH 


Pwr up or Reset: 
OO000000H 
FINIT/FNINIT: OOOOOOOOH 


Pwr up or Reset: 
OO000000H 
FINIT/FNINIT: OOOOOOOOH 


MMO through MM7° 


Pwr up or Reset: 


Pentium IT and Pentium Ill 


Pentium with MMX Technology 


OOOO0000000000000H Processors Only— Only— 
INIT or FINIT/FNINIT: Pwr up or Reset: Pwr up or Reset: 
Unchanged 0000000000000000H 0000000000000000H 
INIT or FINIT/FNINIT: INIT or FINIT/FNINIT: 
Unchanged Unchanged 
XMMO through XMM7_ | Pwr up or Reset: OH If CPUID.O1H:SSE is 1 — NA 
INIT: Unchanged Pwr up or Reset: OH 
INIT: Unchanged 
MXCSR Pwr up or Reset: 1F80H Pentium Ill processor only- NA 
INIT: Unchanged Pwr up or Reset: 1F80H 
INIT: Unchanged 
GDTR, IDTR Base = OOO000000H Base = OOOOQ0000H Base = QOO00000H 


LDTR, Task Register 


Limit = FFFFH 
AR = Present, R/W 


Selector = OOOOH 
Base = OQOO00000H 


Limit = FFFFH 
AR = Present, R/W 


Selector = OOOOH 
Base = OOOO00000H 


Limit = FFFFH 
AR = Present, R/W 


Selector = OOOOH 
Base = OOOO00000H 


Limit = FFFFH Limit = FFFFH Limit = FFFFH 

AR = Present, R/W AR = Present, R/W AR = Present, R/W 
DRO, DR1, DR2, DR3 OOOO00000H OOOO0000H OOO00000H 
DR6 FFFFOFFOH FFFFOFFOH FFFFOFFOH 


23-38 Vol. 3B 


ARCHITECTURE COMPATIBILITY 


Table 23-10. Processor State Following Power-up/Reset/INIT for Pentium, Pentium Pro and Pentium 4 Processors 


Register 


Pentium 4 Processor 


Pentium Pro Processor 


Pentium Processor 


DR7 


00000400H 


00000400H 


00000400H 


Time-Stamp Counter 


Power up or Reset: OH 
INIT: Unchanged 


Power up or Reset: OH 
INIT: Unchanged 


Power up or Reset: OH 
INIT: Unchanged 


Perf. Counters and 
Event Select 


Power up or Reset: OH 
INIT: Unchanged 


Power up or Reset: OH 
INIT: Unchanged 


Power up or Reset: OH 
INIT: Unchanged 


All Other MSRs 


Pwr up or Reset: 


Pwr up or Reset: 


Pwr up or Reset: 


INIT: Unchanged 


INIT: Unchanged 


Undefined Undefined Undefined 
INIT: Unchanged INIT: Unchanged INIT: Unchanged 
Data and Code Cache, | Invalid® Invalid® Invalid® 
TLBs 
Fixed MTRRs Pwr up or Reset: Disabled Pwr up or Reset: Disabled Not Implemented 
INIT: Unchanged INIT: Unchanged 
Variable MTRRs Pwr up or Reset: Disabled Pwr up or Reset: Disabled Not Implemented 


Machine-Check 
Architecture 


Pwr up or Reset: 
Undefined 
INIT: Unchanged 


Pwr up or Reset: 
Undefined 
INIT: Unchanged 


Not Implemented 


INIT: Unchanged 


INIT: Unchanged 


APIC Pwr up or Reset: Enabled Pwr up or Reset: Enabled Pwr up or Reset: Enabled 
INIT: Unchanged INIT: Unchanged INIT: Unchanged 

R8-R15” QOO0000000000000H QOO00000000000000H NA. 

XMM8-XMM157 Pwr up or Reset: OH Pwr up or Reset: OH N.A. 


NOTES: 


1. The 10 most-significant bits of the EFLAGS register are undefined following a reset. Software should not depend on the states of 


any of these bits. 


2. The CD and NW flags are unchanged, bit 4 is set to 1, all other bits are cleared. 
3. Where “n” is the Extended Model Value for the respective processor. 

4. If Built-In Self-Test (BIST) is invoked on power up or reset, EAX is 0 only if all tests passed. (BIST cannot be invoked during an INIT.) 
5. The state of the x87 FPU and MMX registers is not changed by the execution of an INIT. 
6. Internal caches are invalid after power-up and RESET, but left unchanged with an INIT. 
7. lf the processor supports IA-32e mode. 
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15.Updates to Chapter 25, Volume 3C 


Change bars and violet text show changes to Chapter 25 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3C: System Programming Guide, Part 3. 


Changes to this chapter: 
e Updated Section 25.9.1, “Basic VM-Exit Information,” to add bits 25 and 26 to the VMCS Exit Reason field. 
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CHAPTER 25 
VIRTUAL MACHINE CONTROL STRUCTURES 


25.1 OVERVIEW 


A logical processor uses virtual-machine control data structures (VMCSs) while it is in VMX operation. These 
manage transitions into and out of VMX non-root operation (VM entries and VM exits) as well as processor behavior 
in VMX non-root operation. This structure is manipulated by the new instructions VMCLEAR, VMPTRLD, VMREAD, 
and VMWRITE. 


A VMM can use a different VMCS for each virtual machine that it supports. For a virtual machine with multiple 
logical processors (virtual processors), the VMM can use a different VMCS for each virtual processor. 


A logical processor associates a region in memory with each VMCS. This region is called the VMCS region. Soft- 
ware references a specific VMCS using the 64-bit physical address of the region (a VMCS pointer). VMCS pointers 
must be aligned on a 4-KByte boundary (bits 11:0 must be zero). These pointers must not set bits beyond the 
processor’s physical-address width.2'3 


A logical processor may maintain a number of VMCSs that are active. The processor may optimize VMX operation 
by maintaining the state of an active VMCS in memory, on the processor, or both. At any given time, at most one 
of the active VMCSs is the current VMCS. (This document frequently uses the term “the VMCS” to refer to the 
current VMCS.) The VMLAUNCH, VMREAD, VMRESUME, and VMWRITE instructions operate only on the current 
VMCS. 


The following items describe how a logical processor determines which VMCSs are active and which is current: 


¢ The memory operand of the VMPTRLD instruction is the address of a VMCS. After execution of the instruction, 
that VMCS is both active and current on the logical processor. Any other VMCS that had been active remains so, 
but no other VMCS is current. 


¢ The VMCS link pointer field in the current VMCS (see Section 25.4.2) is itself the address of a VMCS. If VM entry 
is performed successfully with the 1-setting of the “VMCS shadowing” VM-execution control, the VMCS 
referenced by the VMCS link pointer field becomes active on the logical processor. The identity of the current 
VMCS does not change. 


¢ The memory operand of the VMCLEAR instruction is also the address of a VMCS. After execution of the 
instruction, that VMCS is neither active nor current on the logical processor. If the VMCS had been current on 
the logical processor, the logical processor no longer has a current VMCS. 


The VMPTRST instruction stores the address of the logical processor’s current VMCS into a specified memory loca- 
tion (it stores the value FFFFFFFF_FFFFFFFFH if there is no current VMCS). 


The launch state of a VMCS determines which VM-entry instruction should be used with that VMCS: the 
VMLAUNCH instruction requires a VMCS whose launch state is “clear”; the VMRESUME instruction requires a VMCS 
whose launch state is “launched”. A logical processor maintains a VMCS’s launch state in the corresponding VMCS 
region. The following items describe how a logical processor manages the launch state of a VMCS: 


¢ If the launch state of the current VMCS is “clear”, successful execution of the VMLAUNCH instruction changes 
the launch state to “launched”. 


¢ The memory operand of the VMCLEAR instruction is the address of a VMCS. After execution of the instruction, 
the launch state of that VMCS is “clear”. 


¢ There are no other ways to modify the launch state of a VMCS (it cannot be modified using VMWRITE) and there 
is no direct way to discover it (it cannot be read using VMREAD). 


1. The amount of memory required for a VMCS region is at most 4 KBytes. The exact size is implementation specific and can be deter- 
mined by consulting the VMX capability MSR I[A32_VMX_BASIC to determine the size of the VMCS region (see Appendix A.1). 


2. Software can determine a processor's physical-address width by executing CPUID with B0O00008H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


3. If IA32_VMX_BASIC[48] is read as 1, these pointers must not set any bits in the range 63:32; see Appendix A.1. 
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Figure 25-1 illustrates the different states of a VMCS. It uses “X” to refer to the VMCS and “Y” to refer to any other 
VMCS. Thus: “VMPTRLD X” always makes X current and active; “VMPTRLD Y” always makes X not current (because 
it makes Y current); VMLAUNCH makes the launch state of X “launched” if X was current and its launch state was 
“clear”; and VMCLEAR X always makes X inactive and not current and makes its launch state “clear”. 


The figure does not illustrate operations that do not modify the VMCS state relative to these parameters (e.g., 
execution of VMPTRLD X when X is already current). Note that VMCLEAR X makes X “inactive, not current, and 
clear,” even if X’s current state is not defined (e.g., even if X has not yet been initialized). See Section 25.11.3. 
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Figure 25-1. States of VMCS X 


Because a shadow VMCS (see Section 25.10) cannot be used for VM entry, the launch state of a shadow VMCS is 
not meaningful. Figure 25-1 does not illustrate all the ways in which a shadow VMCS may be made active. 


25.2 FORMAT OF THE VMCS REGION 


A VMCS region comprises up to 4-KBytes.! The format of a VMCS region is given in Table 25-1. 


Table 25-1. Format of the VMCS Region 


Byte Offset Contents 
0 Bits 30:0: VMCS revision identifier 
Bit 31: shadow-VMCS indicator (see Section 25.10) 
4 VMxX-abort indicator 
8 VMCS data (implementation-specific format) 


1. The exact size is implementation specific and can be determined by consulting the VMX capability MSR [A32_VMX_BASIC to deter- 
mine the size of the VMCS region (see Appendix A.1). 


25-2 Vol. 3C 


VIRTUAL MACHINE CONTROL STRUCTURES 


The first 4 bytes of the VMCS region contain the VMCS revision identifier at bits 30:0.1 Processors that maintain 
VMCS data in different formats (see below) use different VMCS revision identifiers. These identifiers enable soft- 
ware to avoid using a VMCS region formatted for one processor on a processor that uses a different format.? Bit 31 
of this 4-byte region indicates whether the VMCS is a shadow VMCS (see Section 25.10). 


Software should write the VMCS revision identifier to the VMCS region before using that region for a VMCS. The 
VMCS revision identifier is never written by the processor; VMPTRLD fails if its operand references a VMCS region 
whose VMCS revision identifier differs from that used by the processor. (VMPTRLD also fails if the shadow-VMCS 
indicator is 1 and the processor does not support the 1-setting of the “VMCS shadowing” VM-execution control; see 
Section 25.6.2) Software can discover the VMCS revision identifier that a processor uses by reading the VMX capa- 
bility MSR IA32_VMX_BASIC (see Appendix A.1). 


Software should clear or set the shadow-VMCS indicator depending on whether the VMCS is to be an ordinary 
VMCS or a shadow VMCS (see Section 25.10). VMPTRLD fails if the shadow-VMCS indicator is set and the processor 
does not support the 1-setting of the “VMCS shadowing” VM-execution control. Software can discover support for 
this setting by reading the VMX capability MSR IA32_VMX_PROCBASED_CTLS2 (see Appendix A.3.3). 


The next 4 bytes of the VMCS region are used for the VMX-abort indicator. The contents of these bits do not 
control processor operation in any way. A logical processor writes a non-zero value into these bits if a VMX abort 
occurs (see Section 28.7). Software may also write into this field. 


The remainder of the VMCS region is used for VMCS data (those parts of the VMCS that control VMX non-root 
operation and the VMxX transitions). The format of these data is implementation-specific. VMCS data are discussed 
in Section 25.3 through Section 25.9. To ensure proper behavior in VMX operation, software should maintain the 
VMCS region and related structures (enumerated in Section 25.11.4) in writeback cacheable memory. Future 
implementations may allow or require a different memory type?. Software should consult the VMX capability MSR 
IA32_VMX_BASIC (see Appendix A.1). 


25.3. ORGANIZATION OF VMCS DATA 


The VMCS data are organized into six logical groups: 


° Guest-state area. Processor state is saved into the guest-state area on VM exits and loaded from there on 
VM entries. 


* Host-state area. Processor state is loaded from the host-state area on VM exits. 


¢ VM-execution control fields. These fields control processor behavior in VMX non-root operation. They 
determine in part the causes of VM exits. 


¢ VM-exit control fields. These fields control VM exits. 
¢ VM-entry control fields. These fields control VM entries. 


¢ VM-exit information fields. These fields receive information on VM exits and describe the cause and the 
nature of VM exits. On some processors, these fields are read-only.* 


The VM-execution control fields, the VM-exit control fields, and the VM-entry control fields are sometimes referred 
to collectively as VMX controls. 


1. Earlier versions of this manual specified that the VMCS revision identifier was a 32-bit field. For all processors produced prior to this 
change, bit 31 of the VMCS revision identifier was 0. 


2. Logical processors that use the same VMCS revision identifier use the same size for VMCS regions. 


3. Alternatively, software may map any of these regions or structures with the UC memory type. Doing so is strongly discouraged 
unless necessary as it will cause the performance of transitions using those structures to suffer significantly. In addition, the pro- 
cessor will continue to use the memory type reported in the VMX capability MSR I[A32_VMX_BASIC with exceptions noted in Appen- 
dix A.1. 


4. Software can discover whether these fields can be written by reading the VMX capability MSR IA32_VMX_MISC (see Appendix A.6). 
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25.4 GUEST-STATE AREA 


This section describes fields contained in the guest-state area of the VMCS. VM entries load processor state from 
these fields and VM exits store processor state into these fields. See Section 27.3.2 and Section 28.3 for details. 


25.4.1 Guest Register State 


The following fields in the guest-state area correspond to processor registers: 


* Control registers CRO, CR3, and CR4 (64 bits each; 32 bits on processors that do not support Intel 64 archi- 
tecture). 


° Debug register DR7 (64 bits; 32 bits on processors that do not support Intel 64 architecture). 
* RSP, RIP, and RFLAGS (64 bits each; 32 bits on processors that do not support Intel 64 architecture).! 
° The following fields for each of the registers CS, SS, DS, ES, FS, GS, LDTR, and TR: 

— Selector (16 bits). 


— Base address (64 bits; 32 bits on processors that do not support Intel 64 architecture). The base-address 
fields for CS, SS, DS, and ES have only 32 architecturally-defined bits; nevertheless, the corresponding 
VMCS fields have 64 bits on processors that support Intel 64 architecture. 


— Segment limit (32 bits). The limit field is always a measure in bytes. 
— Access rights (32 bits). The format of this field is given in Table 25-2 and detailed as follows: 


¢ The low 16 bits correspond to bits 23:8 of the upper 32 bits of a 64-bit segment descriptor. While bits 
19:16 of code-segment and data-segment descriptors correspond to the upper 4 bits of the segment 
limit, the corresponding bits (bits 11:8) are reserved in this VMCS field. 


¢ Bit 16 indicates an unusable segment. Attempts to use such a segment fault except in 64-bit mode. 
In general, a segment register is unusable if it has been loaded with a null selector.2 


e Bits 31:17 are reserved. 


Table 25-2. Format of Access Rights 


Bit Position(s) Field 

3:0 Segment type 

4 S — Descriptor type (O = system; 1 = code or data) 
6:5 DPL — Descriptor privilege level 

7 P — Segment present 

11:8 Reserved 

12 AVL — Available for use by system software 


1. This chapter uses the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that support VMX oper- 
ation also support Intel 64 architecture. For processors that do not support Intel 64 architecture, this notation refers to the 32-bit 
forms of those registers (EAX, EIP, ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer specifically to lower 32 
bits of the indicated register. 


2. There are a few exceptions to this statement. For example, a segment with a non-null selector may be unusable following a task 
switch that fails after its commit point; see “Interrupt 10—Invalid TSS Exception (#TS)” in Section 6.14, “Exception and Interrupt 
Handling in 64-bit Mode,” of the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. In contrast, the TR reg- 
ister is usable after processor reset despite having a null selector; see Table 11-1 in the Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 3A. 
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Table 25-2. Format of Access Rights (Contd.) 


Bit Position(s) Field 
13 Reserved (except for CS) 
L — 64-bit mode active (for CS only) 
14 D/B — Default operation size (0 = 16-bit segment; 1 = 32-bit segment) 
15 G — Granularity 
16 Segment unusable (0 = usable; 1 = unusable) 
31:17 Reserved 


The base address, segment limit, and access rights compose the “hidden” part (or “descriptor cache”) of each 
segment register. These data are included in the VMCS because it is possible for a segment register’s descriptor 
cache to be inconsistent with the segment descriptor in memory (in the GDT or the LDT) referenced by the 
segment register’s selector. 


The value of the DPL field for SS is always equal to the logical processor’s current privilege level (CPL).! 


On some processors, executions of VMWRITE ignore attempts to write non-zero values to any of bits 11:8 or 
bits 31:17. On such processors, VMREAD always returns 0 for those bits, and VM entry treats those bits as if 
they were all 0 (see Section 27.3.1.2). 


The following fields for each of the registers GDTR and IDTR: 
— Base address (64 bits; 32 bits on processors that do not support Intel 64 architecture). 


— Limit (32 bits). The limit fields contain 32 bits even though these fields are specified as only 16 bits in the 
architecture. 


The following MSRs: 
— IA32_DEBUGCTL (64 bits) 
— IA32_SYSENTER_CS (32 bits) 


— JIA32_SYSENTER_ESP and IA32_SYSENTER_EIP (64 bits; 32 bits on processors that do not support Intel 64 
architecture) 


— IA32_PERF_GLOBAL_CTRL (64 bits). This field is supported only on processors that support the 1-setting 
of the “load IA32_PERF_GLOBAL_CTRL” VM-entry control. 


— IA32_PAT (64 bits). This field is supported only on processors that support either the 1-setting of the “load 
IA32_PAT” VM-entry control or that of the “save IA32_PAT” VM-exit control. 


— IA32_EFER (64 bits). This field is supported only on processors that support either the 1-setting of the “load 
IA32_EFER” VM-entry control or that of the “save IA32_EFER” VM-exit control. 


— IA32_BNDCFGS (64 bits). This field is supported only on processors that support either the 1-setting of the 
“load IA32_BNDCFGS” VM-entry control or that of the “clear IA32_BNDCFGS” VM-exit control. 


— IA32_RTIT_CTL (64 bits). This field is supported only on processors that support either the 1-setting of the 
“load IA32_RTIT_CTL” VM-entry control or that of the “clear IA32_RTIT_CTL” VM-exit control. 


— IA32_LBR_CTL (64 bits). This field is supported only on processors that support either the 1-setting of the 
“load guest IA32_LBR_CTL” VM-entry control or that of the “clear IA32_LBR_CTL” VM-exit control. 


— IA32_S_CET (64 bits; 32 bits on processors that do not support Intel 64 architecture). This field is 
supported only on processors that support the 1-setting of the “load CET state” VM-entry control. 


— IA32_INTERRUPT_SSP_TABLE_ADDR (64 bits; 32 bits on processors that do not support Intel 64 archi- 
tecture). This field is supported only on processors that support the 1-setting of the “load CET state” VM- 
entry control. 


. In protected mode, CPL is also associated with the RPL field in the CS selector. However, the RPL fields are not meaningful in real- 
address mode or in virtual-8086 mode. 
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— IA32_PKRS (64 bits). This field is supported only on processors that support the 1-setting of the “load 
PKRS” VM-entry control. 


The shadow-stack pointer register SSP (64 bits; 32 bits on processors that do not support Intel 64 archi- 
tecture). This field is supported only on processors that support the 1-setting of the “load CET state” VM-entry 
control. 


The register SMBASE (32 bits). This register contains the base address of the logical processor’s SMRAM image. 


25.4.2 Guest Non-Register State 


In addition to the register state described in Section 25.4.1, the guest-state area includes the following fields that 
characterize guest state but which do not correspond to processor registers: 


Activity state (32 bits). This field identifies the logical processor’s activity state. When a logical processor is 

executing instructions normally, it is in the active state. Execution of certain instructions and the occurrence 
of certain events may cause a logical processor to transition to an inactive state in which it ceases to execute 
instructions. 


The following activity states are defined:! 
— 0: Active. The logical processor is executing instructions normally. 
— 1: HLT. The logical processor is inactive because it executed the HLT instruction. 


— 2: Shutdown. The logical processor is inactive because it incurred a triple fault? or some other serious 
error. 


— 3: Wait-for-SIPI. The logical processor is inactive because it is waiting for a startup-IPI (SIPI). 


Future processors may include support for other activity states. Software should read the VMX capability MSR 
IA32_VMX_MISC (see Appendix A.6) to determine what activity states are supported. 


Interruptibility state (32 bits). The IA-32 architecture includes features that permit certain events to be 
blocked for a period of time. This field contains information about such blocking. Details and the format of this 
field are given in Table 25-3. 


Table 25-3. Format of Interruptibility State 


Bit 
Position(s) 


Bit Name 


Notes 


0 


Blocking by STI 


See the “STl—Set Interrupt Flag” section in Chapter 4 of the Intel® 64 and IA-32 Architectures 
Software Developer's Manual, Volume 2B. 


Execution of STI with RFLAGS.IF = 0 blocks maskable interrupts on the instruction boundary 
following its execution.' Setting this bit indicates that this blocking is in effect. 


Blocking by 
MOV SS 


See Section 6.8.3, “Masking Exceptions and Interrupts When Switching Stacks,” in the Intel® 64 
and IA-32 Architectures Software Developer's Manual, Volume 3A. 


Execution of a MOV to SS or a POP to SS blocks or suppresses certain debug exceptions as well 
as interrupts (maskable and nonmaskable) on the instruction boundary following its execution. 
Setting this bit indicates that this blocking is in effect? This document uses the term “blocking 
by MOV SS,” but it applies equally to POP SS. 


Blocking by SMI 


See Section 32.2, “System Management Interrupt (SMI).” System-management interrupts 
(SMIs) are disabled while the processor is in system-management mode (SMM). Setting this bit 
indicates that blocking of SMIs is in effect. 


1. Execution of the MWAIT instruction may put a logical processor into an inactive state. However, this VMCS field never reflects this 
state. See Section 28.1. 


2. Atriple fault occurs when a logical processor encounters an exception while attempting to deliver a double fault. 
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Table 25-3. Format of Interruptibility State (Contd.) 


Bit Bit Name Notes 
Position(s) 
3 Blocking by NMI | See Section 6.7.1, “Handling Multiple NMIs,” in the Intel® 64 and IA-32 Architectures Software 


Developer's Manual, Volume 3A and Section 32.8, “NMI Handling While in SMM.” 


Delivery of a non-maskable interrupt (NMI) or a system-management interrupt (SMI) blocks 
subsequent NMIs until the next execution of IRET. See Section 26.3 for how this behavior of 
IRET may change in VMX non-root operation. Setting this bit indicates that blocking of NMls is 
in effect. Clearing this bit does not imply that NMIs are not (temporarily) blocked for other 
reasons. 

If the “virtual NMIs” VM-execution control (see Section 25.6.1) is 1, this bit does not control the 
blocking of NMIs. Instead, it refers to “virtual-NMI blocking” (the fact that quest software is not 
ready for an NMI). 


4 Enclave Set to 1 if the VM exit occurred while the logical processor was in enclave mode. 


interruption Such VM exits includes those caused by interrupts, non-maskable interrupts, system- 
management interrupts, INIT signals, and exceptions occurring in enclave mode as well as 
exceptions encountered during the delivery of such events incident to enclave mode. 


AVM exit that is incident to delivery of an event injected by VM entry leaves this bit 
unmodified. 


31:5 Reserved VM entry will fail if these bits are not 0. See Section 27.3.1.5. 


NOTES: 

1. Nonmaskable interrupts and system-management interrupts may also be inhibited on the instruction boundary following such an 
execution of STI. 

2. System-management interrupts may also be inhibited on the instruction boundary following such an execution of MOV or POP. 


¢ Pending debug exceptions (64 bits; 32 bits on processors that do not support Intel 64 architecture). IA-32 
processors may recognize one or more debug exceptions without immediately delivering them.! This field 
contains information about such exceptions. This field is described in Table 25-4. 


Table 25-4. Format of Pending-Debug-Exceptions 


Bit Bit Name Notes 

Position(s) 

3:0 B3 - BO When set, each of these bits indicates that the corresponding breakpoint condition was met. 
Any of these bits may be set even if the corresponding enabling bit in DR7 is not set. 

10:4 Reserved VM entry fails if these bits are not 0. See Section 27.3.1.5. 

11 BLD When set, this bit indicates that a bus lock was asserted while OS bus-lock detection was 


enabled and CPL > 0 (see Section 18.3.1.6, “OS Bus-Lock Detection’).! 


12 Enabled When set, this bit indicates that at least one data or I/O breakpoint was met and was enabled in 
breakpoint DR7; the XBEGIN instruction was executed immediately before the VM exit and advanced 
debugging of RTM transactional regions had been enabled; or a bus lock was asserted while 
CPL > O and OS bus-lock detection had been enabled. 


13 Reserved VM entry fails if this bit is not 0. See Section 27.3.1.5. 


1. For example, execution of a MOV to SS or a POP to SS may inhibit some debug exceptions for one instruction. See Section 6.8.3 of 
Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A. In addition, certain events incident to an instruction 
(for example, an INIT signal) may take priority over debug traps generated by that instruction. See Table 6-2 in the Intel® 64 and 
IA-32 Architectures Software Developer's Manual, Volume 3A. 
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Table 25-4. Format of Pending-Debug-Exceptions (Contd.) 


Bit Bit Name Notes 

Position(s) 

14 BS When set, this bit indicates that a debug exception would have been triggered by single-step 
execution mode. 

15 Reserved VM entry fails if this bit is not 0. See Section 27.3.1.5. 

16 RTM When set, this bit indicates that a debug exception (#DB) or a breakpoint exception (#BP) 


occurred inside an RTM region while advanced debugging of RTM transactional regions was 
enabled (see Section 16.3.7, “RTM-Enabled Debugger Support,” of Intel® 64 and IA-32 
Architectures Software Developer's Manual, Volume 1).2 


63:17 Reserved VM entry fails if these bits are not 0. See Section 27.3.1.5. Bits 63:32 exist only on processors 
that support Intel 64 architecture. 


NOTES: 

1. In general, the format of this field matches that of DR6. However, DR6 clears bit 11 to indicate detection of a bus lock, while this field 
sets the bit to indicate that condition. 

2. In general, the format of this field matches that of DR6. However, DR6 clears bit 16 to indicate an RTM-related exception, while this 
field sets the bit to indicate that condition. 


* VMCS link pointer (64 bits). If the “VMCS shadowing” VM-execution control is 1, the VMREAD and VMWRITE 
instructions access the VMCS referenced by this pointer (see Section 25.10). Otherwise, software should set 
this field to FFFFFFFF_FFFFFFFFH to avoid VM-entry failures (see Section 27.3.1.5). 


° VMX-preemption timer value (32 bits). This field is supported only on processors that support the 1-setting 
of the “activate VMX-preemption timer” VM-execution control. This field contains the value that the VMX- 
preemption timer will use following the next VM entry with that setting. See Section 26.5.1 and Section 27.7.4. 


° Page-directory-pointer-table entries (PDPTEs; 64 bits each). These four (4) fields (PDPTEO, PDPTE1, 
PDPTE2, and PDPTE3) are supported only on processors that support the 1-setting of the “enable EPT” VM- 
execution control. They correspond to the PDPTEs referenced by CR3 when PAE paging is in use (see Section 
4.4 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). They are used only if 
the “enable EPT” VM-execution control is 1. 


* Guest interrupt status (16 bits). This field is supported only on processors that support the 1-setting of the 
“virtual-interrupt delivery” VM-execution control. It characterizes part of the guest’s virtual-APIC state and 
does not correspond to any processor or APIC registers. It comprises two 8-bit subfields: 


— Requesting virtual interrupt (RVI). This is the low byte of the guest interrupt status. The processor 
treats this value as the vector of the highest priority virtual interrupt that is requesting service. (The value 
0 implies that there is no such interrupt.) 


— Servicing virtual interrupt (SVI). This is the high byte of the guest interrupt status. The processor treats 
this value as the vector of the highest priority virtual interrupt that is in service. (The value 0 implies that 
there is no such interrupt. ) 


See Chapter 30 for more information on the use of this field. 


° PML index (16 bits). This field is supported only on processors that support the 1-setting of the “enable PML” 
VM-execution control. It contains the logical index of the next entry in the page-modification log. Because the 
page-modification log comprises 512 entries, the PML index is typically a value in the range 0-511. Details of 
the page-modification log and use of the PML index are given in Section 29.3.6. 


25.5 HOST-STATE AREA 


This section describes fields contained in the host-state area of the VMCS. As noted earlier, processor state is 
loaded from these fields on every VM exit (see Section 28.5). 


All fields in the host-state area correspond to processor registers: 
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* CRO, CR3, and CR4 (64 bits each; 32 bits on processors that do not support Intel 64 architecture). 
¢ RSP and RIP (64 bits each; 32 bits on processors that do not support Intel 64 architecture). 


°® Selector fields (16 bits each) for the segment registers CS, SS, DS, ES, FS, GS, and TR. There is no field in the 
host-state area for the LDTR selector. 


¢ Base-address fields for FS, GS, TR, GDTR, and IDTR (64 bits each; 32 bits on processors that do not support 
Intel 64 architecture). 


¢ =The following MSRs: 
— IA32_SYSENTER_CS (32 bits) 
— IA32_SYSENTER_ESP and IA32_SYSENTER_EIP (64 bits; 32 bits on processors that do not support Intel 64 
architecture). 
— IA32_PERF_GLOBAL_CTRL (64 bits). This field is supported only on processors that support the 1-setting 
of the “load IA32_PERF_GLOBAL_CTRL” VM-exit control. 


— IA32_PAT (64 bits). This field is supported only on processors that support the 1-setting of the “load 
IA32_PAT” VM-exit control. 


— IA32_EFER (64 bits). This field is supported only on processors that support the 1-setting of the “load 
IA32_EFER” VM-exit control. 


— IA32_S_CET (64 bits; 32 bits on processors that do not support Intel 64 architecture). This field is 
supported only on processors that support the 1-setting of the “load CET state” VM-exit control. 


— IA32_INTERRUPT_SSP_TABLE_ADDR (64 bits; 32 bits on processors that do not support Intel 64 archi- 
tecture). This field is supported only on processors that support the 1-setting of the “load CET state” VM- 
exit control. 


— IA32_PKRS (64 bits). This field is supported only on processors that support the 1-setting of the “load 
PKRS” VM-exit control. 


° The shadow-stack pointer register SSP (64 bits; 32 bits on processors that do not support Intel 64 archi- 
tecture). This field is supported only on processors that support the 1-setting of the “load CET state” VM-exit 
control. 


In addition to the state identified here, some processor state components are loaded with fixed values on every 
VM exit; there are no fields corresponding to these components in the host-state area. See Section 28.5 for details 
of how state is loaded on VM exits. 


25.6 VM-EXECUTION CONTROL FIELDS 


The VM-execution control fields govern VMX non-root operation. These are described in Section 25.6.1 through 
Section 25.6.8. 


25.6.1 Pin-Based VM-Execution Controls 


The pin-based VM-execution controls constitute a 32-bit vector that governs the handling of asynchronous events 
(for example: interrupts).! Table 25-5 lists the controls. See Chapter 28 for how these controls affect processor 
behavior in VMX non-root operation. 


1. Some asynchronous events cause VM exits regardless of the settings of the pin-based VM-execution controls (see Section 26.2). 
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Table 25-5. Definitions of Pin-Based VM-Execution Controls 


Bit Position(s) | Name Description 
0 External-interrupt | If this control is 1, external interrupts cause VM exits. Otherwise, they are delivered normally 
exiting through the guest interrupt-descriptor table (IDT). If this control is 1, the value of RFLAGS.IF 


does not affect interrupt blocking. 


3 NMI exiting If this control is 1, non-maskable interrupts (NMIs) cause VM exits. Otherwise, they are 
delivered normally using descriptor 2 of the IDT. This control also determines interactions 
between IRET and blocking by NMI (see Section 26.3). 


5 Virtual NMIs If this control is 1, NMIs are never blocked and the “blocking by NMI" bit (bit 3) in the 
interruptibility-state field indicates “virtual-NMI blocking” (see Table 25-3). This control also 
interacts with the “NMI-window exiting” VM-execution control (see Section 25.6.2). 


6 Activate VMX- If this control is 1, the VMX-preemption timer counts down in VMX non-root operation; see 
preemption timer | Section 26.5.1. A VM exit occurs when the timer counts down to zero; see Section 26.2. 

7 Process posted If this control is 1, the processor treats interrupts with the posted-interrupt notification vector 
interrupts (see Section 25.6.8) specially, updating the virtual-APIC page with posted-interrupt requests 


(see Section 30.6). 


All other bits in this field are reserved, some to 0 and some to 1. Software should consult the VMX capability MSRs 
IA32_VMX_PINBASED_CTLS and IA32_VMX_TRUE_PINBASED_CTLS (see Appendix A.3.1) to determine how to set 
reserved bits. Failure to set reserved bits properly causes subsequent VM entries to fail (see Section 27.2.1.1). 


The first processors to support the virtual-machine extensions supported only the 1-settings of bits 1, 2, and 4. The 
VMX capability MSR IA32_VMX_PINBASED_CTLS will always report that these bits must be 1. Logical processors 
that support the O-settings of any of these bits will support the VMX capability MSR IA32_VMX_TRUE_PIN- 
BASED_CTLS MSR, and software should consult this MSR to discover support for the O-settings of these bits. Soft- 
ware that is not aware of the functionality of any one of these bits should set that bit to 1. 


25.6.2 Processor-Based VM-Execution Controls 


The processor-based VM-execution controls constitute three vectors that govern the handling of synchronous 
events, mainly those caused by the execution of specific instructions.! These are the primary processor-based 
VM-execution controls (32 bits), the secondary processor-based VM-execution controls (32 bits), and the 
tertiary VM-execution controls (64 bits). 


Table 25-6 lists the primary processor-based VM-execution controls. See Chapter 26 for more details of how these 
controls affect processor behavior in VMX non-root operation. 


Table 25-6. Definitions of Primary Processor-Based VM-Execution Controls 


Bit Position(s) | Name Description 

2 Interrupt-window _ | If this control is 1,a VM exit occurs at the beginning of any instruction if RFLAGS.IF = 1 and 
exiting there are no other blocking of interrupts (see Section 25.4.2). 

3 Use TSC offsetting | This control determines whether executions of RDTSC, executions of RDTSCP, and executions 


of RDMSR that read from the [A32_TIME_STAMP_COUNTER MSR return a value modified by 
the TSC offset field (see Section 25.6.5 and Section 26.3). 


7 HLT exiting This control determines whether executions of HLT cause VM exits. 

9 INVLPG exiting This determines whether executions of INVLPG cause VM exits. 

10 MWAIT exiting This control determines whether executions of MWAIT cause VM exits. 
11 RDPMC exiting This control determines whether executions of RDPMC cause VM exits. 


1. Some instructions cause VM exits regardless of the settings of the processor-based VM-execution controls (see Section 26.1.2), as 
do task switches (see Section 26.2). 
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Table 25-6. Definitions of Primary Processor-Based VM-Execution Controls (Contd.) 


Bit Position(s) | Name Description 
12 RDTSC exiting This control determines whether executions of RDTSC and RDTSCP cause VM exits. 
15 CR3-load exiting In conjunction with the CR3-target controls (see Section 25.6.7), this control determines 
whether executions of MOV to CR3 cause VM exits. See Section 26.1.3. 
The first processors to support the virtual-machine extensions supported only the 1-setting 
of this control. 
16 CR3-store exiting | This control determines whether executions of MOV from CR3 cause VM exits. 
The first processors to support the virtual-machine extensions supported only the 1-setting 
of this control. 
17 Activate tertiary This control determines whether the tertiary processor-based VM-execution controls are 
controls used. If this control is 0, the logical processor operates as if all the tertiary processor-based 
\V/M-execution controls were also 0. 
19 CR8-load exiting This control determines whether executions of MOV to CR8 cause VM exits. 
20 CR8-store exiting | This control determines whether executions of MOV from CR8 cause VM exits. 
21 Use TPR shadow Setting this control to 1 enables TPR virtualization and other APIC-virtualization features. See 
Chapter 30. 
22 NMI-window If this control is 1,a VM exit occurs at the beginning of any instruction if there is no virtual- 
exiting NMI blocking (see Section 25.4.2). 
23 MOV-DR exiting This control determines whether executions of MOV DR cause VM exits. 
24 Unconditional I/O —_| This control determines whether executions of I/O instructions (IN, INS/INSB/INSW/INSD, OUT, 
exiting and OUTS/OUTSB/OUTSW/OUTSD) cause VM exits. 
25 Use I/O bitmaps This control determines whether I/O bitmaps are used to restrict executions of I/O instructions 
(see Section 25.6.4 and Section 26.1.3). 
For this control, “O” means “do not use I/O bitmaps” and “1” means “use I/O bitmaps.” If the I/O 
bitmaps are used, the setting of the “unconditional I/O exiting” control is ignored. 
27 Monitor trap flag If this control is 1, the monitor trap flag debugging feature is enabled. See Section 26.5.2. 
28 Use MSR bitmaps | This control determines whether MSR bitmaps are used to control execution of the RDMSR 
and WRMSR instructions (See Section 25.6.9 and Section 26.1.3). 
For this control, “O” means “do not use MSR bitmaps” and “1” means “use MSR bitmaps.” If the 
MSR bitmaps are not used, all executions of the RDMSR and WRMSR instructions cause 
VM exits. 
29 MONITOR exiting | This control determines whether executions of MONITOR cause VM exits. 
30 PAUSE exiting This control determines whether executions of PAUSE cause VM exits. 
31 Activate secondary | This control determines whether the secondary processor-based VM-execution controls are 
controls used. If this control is 0, the logical processor operates as if all the secondary processor-based 
V/M-execution controls were also 0. 


All other bits in this field are reserved, some to 0 and some to 1. Software should consult the VMX capability MSRs 
IA32_VMX_PROCBASED_CTLS and IA32_VMX_TRUE_PROCBASED_CTLS (see Appendix A.3.2) to determine how 
to set reserved bits. Failure to set reserved bits properly causes subsequent VM entries to fail (see Section 


272.4.1): 


The first processors to support the virtual-machine extensions supported only the 1-settings of bits 1, 4-6, 8, 13- 
16, and 26. The VMX capability MSR IA32_VMX_PROCBASED_CTLS will always report that these bits must be 1. 
Logical processors that support the O-settings of any of these bits will support the VMX capability MSR IA32_VMxX- 
_TRUE_PROCBASED_CTLS MSR, and software should consult this MSR to discover support for the 0-settings of 
these bits. Software that is not aware of the functionality of any one of these bits should set that bit to 1. 


Bit 31 of the primary processor-based VM-execution controls determines whether the secondary processor-based 
VM-execution controls are used. If that bit is 0, VM entry and VMX non-root operation function as if all the 
secondary processor-based VM-execution controls were 0. Processors that support only the O-setting of bit 31 of 
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the primary processor-based VM-execution controls do not support the secondary processor-based VM-execution 


controls. 


Table 25-7 lists the secondary processor-based VM-execution controls. See Chapter 26 for more details of how 
these controls affect processor behavior in VMX non-root operation. 


Table 25-7. Definitions of Secondary Processor-Based VM-Execution Controls 


Bit Position(s) | Name Description 
0 Virtualize APIC If this control is 1, the logical processor treats specially accesses to the page with the APIC- 
accesses access address. See Section 30.4. 
1 Enable EPT If this control is 1, extended page tables (EPT) are enabled. See Section 29.3. 
2 Descriptor-table This control determines whether executions of LGDT, LIDT, LLDT, LTR, SGDT, SIDT, SLDT, and 
exiting STR cause VM exits. 
3 Enable RDTSCP If this control is 0, any execution of RDTSCP causes an invalid-opcode exception (#UD). 
4 Virtualize x2APIC | If this control is 1, the logical processor treats specially RDMSR and WRMSR to APIC MSRs (in 
mode the range 800H-8FFH). See Section 30.5. 
5 Enable VPID If this control is 1, cached translations of linear addresses are associated with a virtual- 
processor identifier (VPID). See Section 29.1. 
6 WBINVD exiting This control determines whether executions of WBINVD and WBNOINVD cause VM exits. 
7 Unrestricted guest | This control determines whether guest software may run in unpaged protected mode or in real- 
address mode. 
8 APIC-register If this control is 1, the logical processor virtualizes certain APIC accesses. See Section 30.4 and 
virtualization Section 30.5. 
9 Virtual-interrupt This controls enables the evaluation and delivery of pending virtual interrupts as well as the 
delivery emulation of writes to the APIC registers that control interrupt prioritization. 
10 PAUSE-loop exiting | This control determines whether a series of executions of PAUSE can cause a VM exit (see 
Section 25.6.13 and Section 26.1.3). 
11 RDRAND exiting This control determines whether executions of RDRAND cause VM exits. 
12 Enable INVPCID If this control is 0, any execution of INVPCID causes a #UD. 
13 Enable Setting this control to 1 enables use of the VMFUNC instruction in VMX non-root operation. See 
VM functions Section 26.5.6. 
14 VMCS shadowing If this control is 1, executions of VMREAD and VMWRITE in VMX non-root operation may access 
a shadow VMCS (instead of causing VM exits). See Section 25.10 and Section 31.3. 
15 Enable ENCLS If this control is 1, executions of ENCLS consult the ENCLS-exiting bitmap to determine whether 
exiting the instruction causes a VM exit. See Section 25.6.16 and Section 26.1.3. 
16 RDSEED exiting This control determines whether executions of RDSEED cause VM exits. 
17 Enable PML If this control is 1, an access to a quest-physical address that sets an EPT dirty bit first adds an 
entry to the page-modification log. See Section 29.3.6. 
18 EPT-violation #VE | If this control is 1, EPT violations may cause virtualization exceptions (#VE) instead of VM exits. 
See Section 26.5.7. 
19 Conceal VMX from _| If this control is 1, Intel Processor Trace suppresses from PIPs an indication that the processor 
PT was in VMX non-root operation and omits a VMCS packet from any PSB+ produced in VMX non- 
root operation (see Chapter 33). 
20 Enable If this control is 0, any execution of XSAVES or XRSTORS causes a #UD. 
XSAVES/XRSTORS 
21 PASID translation —_| If this control is 1, PASID translation is performed for executions of ENQCMD and ENQCMDS. See 
Section 26.5.8. 
22 Mode-based If this control is 1, EPT execute permissions are based on whether the linear address being 
execute control for | accessed is supervisor mode or user mode. See Chapter 29. 
EPT 
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Table 25-7. Definitions of Secondary Processor-Based VM-Execution Controls (Contd.) 


Bit Position(s) | Name Description 
23 Sub-page write If this control is 1, EPT write permissions may be specified at the granularity of 128 bytes. See 
permissions for Section 29.3.4. 
EPT 
24 Intel PT uses guest | If this control is 1, all output addresses used by Intel Processor Trace are treated as quest- 
physical addresses | physical addresses and translated using EPT. See Section 26.5.4. 
25 Use TSC scaling This control determines whether executions of RDTSC, executions of RDTSCP, and executions 
of RDMSR that read from the I[A32_TIME_STAMP_COUNTER MSR return a value modified by the 
TSC multiplier field (see Section 25.6.5 and Section 26.3). 
26 Enable user wait If this control is 0, any execution of TPAUSE, UMONITOR, or UMWAIT causes a #UD. 
and pause 
27 Enable PCONFIG If this control is 0, any execution of PCONFIG causes a #UD. 
28 Enable ENCLV If this control is 1, executions of ENCLV consult the ENCLV-exiting bitmap to determine whether 
exiting the instruction causes a VM exit. See Section 25.6.17 and Section 26.1.3. 
30 V/MM bus-lock This control determines whether assertion of a bus lock causes a VM exit. See Section 26.2. 
detection 
31 Instruction timeout | If this control is 1,a VM exit occurs if certain operations prevent the processor from reaching an 
instruction boundary within a specified amount of time. See Section 25.6.25 and Section 26.2. 


All other bits in this field are reserved to 0. Software should consult the VMX capability MSR IA32_VMX_PROC- 
BASED_CTLS2 (see Appendix A.3.3) to determine which bits may be set to 1. Failure to clear reserved bits causes 
subsequent VM entries to fail (see Section 27.2.1.1). 


Bit 17 of the primary processor-based VM-execution controls determines whether the tertiary processor-based 
VM-execution controls are used. If that bit is 0, VM entry and VMX non-root operation function as if all the tertiary 
processor-based VM-execution controls were 0. Processors that support only the O-setting of bit 17 of the primary 
processor-based VM-execution controls do not support the tertiary processor-based VM-execution controls. 


Table 25-8 lists the tertiary processor-based VM-execution controls. See Chapter 26 for more details of how these 
controls affect processor behavior in VMX non-root operation. 


Table 25-8. Definitions of Tertiary Processor-Based VM-Execution Controls 


Bit Position(s) | Name Description 

0 LOADIWKEY exiting | This control determines whether executions of LOADIWKEY cause VM exits. 

1 Enable HLAT This control enables hypervisor-managed linear-address translation. See Section 4.5.1. 

2 EPT paging-write _| If this control is 1, EPT permissions can be specified to allow writes only for paging-related 


control 


updates. See Section 29.3.3.2. 


3 Guest-paging If this control is 1, EPT permissions can be specified to prevent accesses using linear addresses 
verification whose translation has certain properties. See Section 29.3.3.2. 
4 IPI virtualization If this control is 1, virtualization of interprocessor interrupts (IPIs) is enabled. See Section 
30.1.6. 
7 Virtualize If this control is 1, the operation of the RDMSR and WRMSR instructions is changed when 


IA32_SPEC_CTRL 


accessing the IA32_SPEC_CTRL MSR. See Section 26.3. 


All other bits in this field are reserved to 0. Software should consult the VMX capability MSR IA32_VMX_PROC- 
BASED_CTLS3 (see Appendix A.3.4) to determine which bits may be set to 1. Failure to clear reserved bits causes 
subsequent VM entries to fail (see Section 27.2.1.1). 
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25.6.3. Exception Bitmap 


The exception bitmap is a 32-bit field that contains one bit for each exception. When an exception occurs, its 
vector is used to select a bit in this field. If the bit is 1, the exception causes a VM exit. If the bit is 0, the exception 
is delivered normally through the IDT, using the descriptor corresponding to the exception’s vector. 


Whether a page fault (exception with vector 14) causes a VM exit is determined by bit 14 in the exception bitmap 
as well as the error code produced by the page fault and two 32-bit fields in the VMCS (the page-fault error-code 
mask and page-fault error-code match). See Section 26.2 for details. 


25.6.4 = 1/0-Bitmap Addresses 


The VM-execution control fields include the 64-bit physical addresses of I/O bitmaps A and B (each of which are 
4 KBytes in size). I/O bitmap A contains one bit for each I/O port in the range OOOOH through 7FFFH; I/O bitmap B 
contains bits for ports in the range 8000H through FFFFH. 


A logical processor uses these bitmaps if and only if the “use I/O bitmaps” control is 1. If the bitmaps are used, 
execution of an I/O instruction causes a VM exit if any bit in the I/O bitmaps corresponding to a port it accesses is 
1. See Section 26.1.3 for details. If the bitmaps are used, their addresses must be 4-KByte aligned. 


25.6.5 Time-Stamp Counter Offset and Multiplier 


The VM-execution control fields include a 64-bit TSC-offset field. If the “RDTSC exiting” control is 0 and the “use 
TSC offsetting” control is 1, this field controls executions of the RDTSC and RDTSCP instructions. It also controls 
executions of the RDMSR instruction that read from the IA32_TIME_STAMP_COUNTER MSR. For all of these, the 
value of the TSC offset is added to the value of the time-stamp counter, and the sum is returned to guest software 
in EDX: EAX. 


Processors that support the 1-setting of the “use TSC scaling” control also support a 64-bit TSC-multiplier field. 
If this control is 1 (and the “RDTSC exiting” control is 0 and the “use TSC offsetting” control is 1), this field also 
affects the executions of the RDTSC, RDTSCP, and RDMSR instructions identified above. Specifically, the contents 
of the time-stamp counter is first multiplied by the TSC multiplier before adding the TSC offset. 


See Chapter 26 for a detailed treatment of the behavior of RDTSC, RDTSCP, and RDMSR in VMX non-root operation. 


25.6.6 Guest/Host Masks and Read Shadows for CRO and CR4 


VM-execution control fields include guest/host masks and read shadows for the CRO and CR4 registers. These 
fields control executions of instructions that access those registers (including CLTS, LMSW, MOV CR, and SMSW), 
They are 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not. 


In general, bits set to 1 in a guest/host mask correspond to bits “owned” by the host: 


* Guest attempts to set them (using CLTS, LMSW, or MOV to CR) to values differing from the corresponding bits 
in the corresponding read shadow cause VM exits. 


* Guest reads (using MOV from CR or SMSW) return values for these bits from the corresponding read shadow. 


Bits cleared to 0 correspond to bits “owned” by the guest; guest attempts to modify them succeed and guest reads 
return values for these bits from the control register itself. 


See Chapter 28 for details regarding how these fields affect VMX non-root operation. 


25.6.7. CR3-Target Controls 


The VM-execution control fields include a set of 4 CR3-target values and a CR3-target count. The CR3-target 
values each have 64 bits on processors that support Intel 64 architecture and 32 bits on processors that do not. The 
CR3-target count has 32 bits on all processors. 
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An execution of MOV to CR3 in VMX non-root operation does not cause a VM exit if its source operand matches one 
of these values. If the CR3-target count is n, only the first n CR3-target values are considered; if the CR3-target 
count is 0, MOV to CR3 always causes a VM exit. 


There are no limitations on the values that can be written for the CR3-target values. VM entry fails (see Section 
27.2) if the CR3-target count is greater than 4. 


Future processors may support a different number of CR3-target values. Software should read the VMX capability 
MSR IA32_VMX_MISC (see Appendix A.6) to determine the number of values supported. 


25.6.8 Controls for APIC Virtualization 


There are three mechanisms by which software accesses registers of the logical processor’s local APIC: 


¢ If the local APIC is in xAPIC mode, it can perform memory-mapped accesses to addresses in the 4-KByte page 
referenced by the physical address in the IA32_APIC_BASE MSR (see Section 11.4.4, “Local APIC Status and 
Location,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, and the Intel® 64 
Architecture Processor Topology Enumeration Technical Paper).! 


¢ If the local APIC is in x2APIC mode, it can accesses the local APIC’s registers using the RDMSR and WRMSR 
instructions (see the Intel® 64 Architecture Processor Topology Enumeration Technical Paper). 


¢ In 64-bit mode, it can access the local APIC’s task-priority register (TPR) using the MOV CR8 instruction. 
Several processor-based VM-execution controls (see Section 25.6.2) control such accesses. These are “use TPR 


uN uWeNM uN 


shadow”, “virtualize APIC accesses”, “virtualize x2APIC mode”, “virtual-interrupt delivery”, “APIC-register virtual- 
ization”, and “IPI virtualization”. These controls interact with the following fields: 


¢ APIC-access address (64 bits). This field contains the physical address of the 4-KByte APIC-access page. 
If the “virtualize APIC accesses” VM-execution control is 1, access to this page may cause VM exits or be 
virtualized by the processor. See Section 30.4. 


The APIC-access address exists only on processors that support the 1-setting of the “virtualize APIC accesses” 
VM-execution control. 


° Virtual-APIC address (64 bits). This field contains the physical address of the 4-KByte virtual-APIC page. 
The processor uses the virtual-APIC page to virtualize certain accesses to APIC registers and to manage virtual 
interrupts; see Chapter 30. 


Depending on the setting of the controls indicated earlier, the virtual-APIC page may be accessed by the 
following operations: 


— The MOV CR8 instructions (see Section 30.3). 


— Accesses to the APIC-access page if, in addition, the “virtualize APIC accesses” VM-execution control is 1 
(see Section 30.4). 


— The RDMSR and WRMSR instructions if, in addition, the value of ECX is in the range 800H-8FFH (indicating 
an APIC MSR) and the “virtualize x2APIC mode” VM-execution control is 1 (see Section 30.5). 


If the “use TPR shadow” VM-execution control is 1, VM entry ensures that the virtual-APIC address is 4-KByte 
aligned. The virtual-APIC address exists only on processors that support the 1-setting of the “use TPR shadow” 
VM-execution control. 


° TPR threshold (32 bits). Bits 3:0 of this field determine the threshold below which bits 7:4 of VTPR (see 
Section 30.1.1) cannot fall. If the “virtual-interrupt delivery” VM-execution control is 0, a VM exit occurs after 
an operation (e.g., an execution of MOV to CR8) that reduces the value of those bits below the TPR threshold. 
See Section 30.1.2. 


The TPR threshold exists only on processors that support the 1-setting of the “use TPR shadow” VM-execution 
control. 


° EOI-exit bitmap (4 fields; 64 bits each). These fields are supported only on processors that support the 1- 
setting of the “virtual-interrupt delivery” VM-execution control. They are used to determine which virtualized 
writes to the APIC’s EOI register cause VM exits: 


1. If the local APIC does not support x2APIC mode, it is always in xAPIC mode. 
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— EOI_EXITO contains bits for vectors from 0 (bit 0) to 63 (bit 63). 

— EOI_EXIT1 contains bits for vectors from 64 (bit 0) to 127 (bit 63). 
— EOI_EXIT2 contains bits for vectors from 128 (bit 0) to 191 (bit 63). 
— EOI_EXIT3 contains bits for vectors from 192 (bit 0) to 255 (bit 63). 
See Section 30.1.4 for more information on the use of this field. 

* Posted-interrupt notification vector (16 bits). This field is supported only on processors that support the 1- 
setting of the “process posted interrupts” VM-execution control. Its low 8 bits contain the interrupt vector that 
is used to notify a logical processor that virtual interrupts have been posted. See Section 30.6 for more 
information on the use of this field. 

* Posted-interrupt descriptor address (64 bits). This field is supported only on processors that support the 1- 
setting of the “process posted interrupts” VM-execution control. It is the physical address of a 64-byte aligned 
posted interrupt descriptor. See Section 30.6 for more information on the use of this field. 

¢ PID-pointer table address (64 bits). This field contains the physical address of the PID-pointer table. If the 


‘IPI virtualization” VM-execution control is 1, the logical processor uses entries in this table to virtualize IPIs. 
See Section 30.1.6. 


¢ Last PID-pointer index (16 bits). This field contains the index of the last entry in the PID-pointer table. 


25.6.9 MSR-Bitmap Address 


On processors that support the 1-setting of the “use MSR bitmaps” VM-execution control, the VM-execution control 
fields include the 64-bit physical address of four contiguous MSR bitmaps, which are each 1-KByte in size. This 
field does not exist on processors that do not support the 1-setting of that control. The four bitmaps are: 


* Read bitmap for low MSRs (located at the MSR-bitmap address). This contains one bit for each MSR address 
in the range OOOOOOOOH to OOOO1FFFH. The bit determines whether an execution of RDMSR applied to that 
MSR causes a VM exit. 


* Read bitmap for high MSRs (located at the MSR-bitmap address plus 1024). This contains one bit for each 
MSR address in the range COOOO000H toCOO0iFFFH. The bit determines whether an execution of RDMSR 
applied to that MSR causes a VM exit. 


° Write bitmap for low MSRs (located at the MSR-bitmap address plus 2048). This contains one bit for each 
MSR address in the range OOOOO000H to OOOO1FFFH. The bit determines whether an execution of WRMSR 
applied to that MSR causes a VM exit. 


* Write bitmap for high MSRs (located at the MSR-bitmap address plus 3072). This contains one bit for each 
MSR address in the range COOOO000H toCOOO1iFFFH. The bit determines whether an execution of WRMSR 
applied to that MSR causes a VM exit. 


A logical processor uses these bitmaps if and only if the “use MSR bitmaps” control is 1. If the bitmaps are used, an 
execution of RDMSR or WRMSR causes a VM exit if the value of RCX is in neither of the ranges covered by the 
bitmaps or if the appropriate bit in the MSR bitmaps (corresponding to the instruction and the RCX value) is 1. See 
Section 26.1.3 for details. If the bitmaps are used, their address must be 4-KByte aligned. 


25.6.10 Executive-VMCS Pointer 


The executive-VMCS pointer is a 64-bit field used in the dual-monitor treatment of system-management interrupts 
(SMIs) and system-management mode (SMM). SMM VM exits save this field as described in Section 32.15.2. 
VM entries that return from SMM use this field as described in Section 32.15.4. 
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25.6.11 €Extended-Page-Table Pointer (EPTP) 


The extended-page-table pointer (EPTP) contains the address of the base of EPT PML4 table (see Section 
29.3.2), as well as other EPT configuration information. The format of this field is shown in Table 25-9. 


Table 25-9. Format of Extended-Page-Table Pointer 


Bit Field 
Position(s) 
2:0 EPT paging-structure memory type (see Section 29.3.7): 


O = Uncacheable (UC) 
6 = Write-back (WB) 


Other values are reserved. ! 


5:3 This value is 1 less than the EPT page-walk length (see Section 29.3.2) 

6 Setting this control to 1 enables accessed and dirty flags for EPT (see Section 29,3.5)¢ 

7 Setting this control to 1 enables enforcement of access rights for supervisor shadow-stack pages (see Section 
29.3.3.2)3 

11:8 Reserved 

N-1:12 Bits N-1:12 of the physical address of the 4-KByte aligned EPT paging-structure (an EPT PML4 table with 4-level 
EPT and an EPT PMLS table with 5-level EPT)* 

63:N Reserved 

NOTES: 


1. Software should read the VMX capability MSR I[A32_VMX_EPT_VPID_CAP (see Appendix A.10) to determine what EPT paging-struc- 
ture memory types are supported. 

2. Not all processors support accessed and dirty flags for EPT. Software should read the VMX capability MSR 1A32_VMX_EPT_VPID_- 
CAP (see Appendix A.10) to determine whether the processor supports this feature. 

3. Not all processors enforce access rights for shadow-stack pages. Software should read the VMX capability MSR IA32_VMX- 
_EPT_VPID_CAP (see Appendix A.10) to determine whether the processor supports this feature. 


4. Nis the physical-address width supported by the logical processor. Software can determine a processor's physical-address width by 
executing CPUID with 8OOO0008H in EAX. The physical-address width is returned in bits 7:0 of EAX. 


The EPTP exists only on processors that support the 1-setting of the “enable EPT” VM-execution control. 


25.6.12 Virtual-Processor Identifier (VPID) 


The virtual-processor identifier (VPID) is a 16-bit field. It exists only on processors that support the 1-setting 
of the “enable VPID” VM-execution control. See Section 29.1 for details regarding the use of this field. 


25.6.13 Controls for PAUSE-Loop Exiting 
On processors that support the 1-setting of the “PAUSE-loop exiting” VM-execution control, the VM-execution 
control fields include the following 32-bit fields: 


¢ PLE_Gap. Software can configure this field as an upper bound on the amount of time between two successive 
executions of PAUSE in a loop. 


¢ PLE_Window. Software can configure this field as an upper bound on the amount of time a guest is allowed to 
execute in a PAUSE loop. 


These fields measure time based on a counter that runs at the same rate as the timestamp counter (TSC). See 
Section 26.1.3 for more details regarding PAUSE-loop exiting. 
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25.6.14 \VM-Function Controls 


The VM-function controls constitute a 64-bit vector that governs use of the VMFUNC instruction in VMX non-root 
operation. This field is supported only on processors that support the 1-settings of both the “activate secondary 
controls” primary processor-based VM-execution control and the “enable VM functions” secondary processor- 
based VM-execution control. 


Table 25-10 lists the VM-function controls. See Section 26.5.6 for more details of how these controls affect 
processor behavior in VMX non-root operation. 


Table 25-10. Definitions of VM-Function Controls 


Bit Position(s) | Name Description 
0 EPTP switching The EPTP-switching VM function changes the EPT pointer to a value chosen from the EPTP list. 
See Section 26.5.6.3. 


All other bits in this field are reserved to 0. Software should consult the VMX capability MSR IA32_VMX_VMFUNC 
(see Appendix A.11) to determine which bits are reserved. Failure to clear reserved bits causes subsequent 
VM entries to fail (see Section 27.2.1.1). 


Processors that support the 1-setting of the “EPTP switching” VM-function control also support a 64-bit field called 
the EPTP-list address. This field contains the physical address of the 4-KByte EPTP list. The EPTP list comprises 
512 8-Byte entries (each an EPTP value) and is used by the EPTP-switching VM function (see Section 26.5.6.3). 


25.6.15 VMCS Shadowing Bitmap Addresses 


On processors that support the 1-setting of the “VMCS shadowing” VM-execution control, the VM-execution control 
fields include the 64-bit physical addresses of the VMREAD bitmap and the VMWRITE bitmap. Each bitmap is 4 
KBytes in size and thus contains 32 KBits. The addresses are the VMREAD-bitmap address and the VMWRITE- 
bitmap address. 


If the “VMCS shadowing” VM-execution control is 1, executions of VMREAD and VMWRITE may consult these 
bitmaps (see Section 25.10 and Section 31.3). 


25.6.16 ENCLS-Exiting Bitmap 


The ENCLS-exiting bitmap is a 64-bit field. If the “enable ENCLS exiting” VM-execution control is 1, execution of 
ENCLS causes a VM exit if the bit in this field corresponding to the value of EAX is 1. If the bit is 0, the instruction 
executes normally. See Section 26.1.3 for more information. 


25.6.17 ENCLV-Exiting Bitmap 


The ENCLV-exiting bitmap is a 64-bit field. If the “enable ENCLV exiting” VM-execution control is 1, execution of 
ENCLV causes a VM exit if the bit in this field corresponding to the value of EAX is 1. If the bit is 0, the instruction 
executes normally. See Section 26.1.3 for more information. 


25.6.18 PCONFIG-Exiting Bitmap 


The PCONFIG-exiting bitmap is a 64-bit field. If the “enable PCONFIG” VM-execution control is 1, execution of 
PCONFIG causes a VM exit if the bit in this field corresponding to the value of EAX is 1. If the control is 0, any 
execution of PCONFIG causes a #UD. See Section 26.1.3 for more information. 
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25.6.19 Control Field for Page-Modification Logging 


The PML address is a 64-bit field. It is the 4-KByte aligned address of the page-modification log. The page- 
modification log consists of 512 64-bit entries. It is used for the page-modification logging feature. Details of the 
page-modification logging are given in Section 29.3.6. 


If the “enable PML” VM-execution control is 1, VM entry ensures that the PML address is 4-KByte aligned. The PML 
address exists only on processors that support the 1-setting of the “enable PML” VM-execution control. 


25.6.20 Controls for Virtualization Exceptions 


On processors that support the 1-setting of the “EPT-violation #VE” VM-execution control, the VM-execution 
control fields include the following: 


° Virtualization-exception information address (64 bits). This field contains the physical address of the 
virtualization-exception information area. When a logical processor encounters a virtualization exception, 
it saves virtualization-exception information at the virtualization-exception information address; see Section 
26.5.7.2. 


¢ EPTP index (16 bits). When an EPT violation causes a virtualization exception, the processor writes the value 
of this field to the virtualization-exception information area. The EPTP-switching VM function updates this field 
(see Section 26.5.6.3). 


25.6.21 XSS-Exiting Bitmap 


On processors that support the 1-setting of the “enable XSAVES/XRSTORS” VM-execution control, the VM-execu- 
tion control fields include a 64-bit XSS-exiting bitmap. If the “enable XSAVES/XRSTORS” VM-execution control is 
1, executions of XSAVES and XRSTORS may consult this bitmap (see Section 26.1.3 and Section 26.3). 


25.6.22 Sub-Page-Permission-Table Pointer (SPPTP) 


If the sub-page write-permission feature of EPT is enabled, EPT write permissions may be determined at a 128- 
byte granularity (see Section 29.3.4). These permissions are determined using a hierarchy of sub-page-permission 
structures in memory. 


The root of this hierarchy is referenced by a VM-execution control field called the sub-page-permission-table 
pointer (SPPTP). The SPPTP contains the address of the base of the root SPP table (see Section 29.3.4.2). The 
format of this field is shown in Table 25-9. 


Table 25-11. Format of Sub-Page-Permission-Table Pointer 


Bit Field 
Position(s) 
11:0 Reserved 
N-1:12 Bits N-1:12 of the physical address of the 4-KByte aligned root SPP table 
63:N! Reserved 
NOTES: 


1. Nis the processor's physical-address width. Software can determine this width by executing CPUID with BOOOOOO08H in EAX. The 
physical-address width is returned in bits 7:0 of EAX. 


The SPPTP exists only on processors that support the 1-setting of the “sub-page write permissions for EPT” VM- 
execution control. 
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25.6.23 Fields Related to Hypervisor-Managed Linear-Address Translation 


Two fields are used when the “enable HLAT” VM-execution control is 1, enabling HLAT paging: 


¢ The hypervisor-managed linear-address translation pointer (HLAT pointer or HLATP) is used by HLAT 
paging to locate and access the first paging structure used for linear-address translation (see Section 4.5). The 
format of this field is shown in Table 25-12. 


Table 25-12. Format of Hypervisor-Managed Linear-Address Translation Pointer 


Bit Field 

Position(s) 

2:0 Reserved 

3 (PWT) Page-level write-through; indirectly determines the memory type used to access the first HLAT paging structure 
during linear-address translation. 

4 (PCD) Page-level cache disable; indirectly determines the memory type used to access the first HLAT paging structure 
during linear-address translation. 

11:5 Reserved 

N-1:12 Guest-physical address (4KB-aligned) of the first HLAT paging structure during linear-address translation. ! 

63:N Reserved 

NOTES: 


1. Nis the physical-address width supported by the logical processor. Software can determine a processor's physical-address width by 
executing CPUID with 8OOOO008H in EAX. The physical-address width is returned in bits 7:0 of EAX. 


¢ The HLAT prefix size. The value of this field determines which linear address are subject to HLAT paging. See 
Section 4.5.1. 


These fields exist only on processors that support the 1-setting of the “enable HLAT” VM-execution control. 


25.6.24 Fields Related to PASID Translation 


Two 64-bit VM-execution control fields are used when the “PASID translation” VM-execution control is 1, enabling 
translation of PASIDs for executions of ENQCMD and ENQCMDS: the low PASID directory address and the high 
PASID directory address. These are the physical addresses of the low PASID directory and the high PASID direc- 
tory, respectively. These fields exist only on processors that support the 1-setting of the “PASID translation” VM- 
execution control. 


See Section 26.5.8 for information on the PASID-translation process for ENQCMD and ENQCMDS. 


25.6.25 _ Instruction-Timeout Control 


On processors that support the 1-setting of the “instruction timeout” VM-execution control, the VM-execution 
control fields include a 32-bit instruction-timeout control. The processor interprets the value of this field as an 
amount of time as measured in units of crystal clock cycles.! If the “instruction timeout” VM-execution control is 1, 
a VM exit occurs if certain operations prevent the processor from reaching an instruction boundary within this 
amount of time. 


1. CPUID.15H:ECX enumerates the nominal frequency of the core crystal clock in Hz. 
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25.6.26 Fields Controlling Virtualization of the IA32_SPEC_CTRL MSR 


On processors that support the 1-setting of the “virtualize IA32_SPEC_CTRL” VM-execution control, the VM-execu- 
tion control fields include the following 64-bit fields: 


¢ IA32_SPEC_CTRL mask. Setting a bit in this field prevents guest software from modifying the corresponding 
bit in the IA32_SPEC_CTRL MSR. 


° IA32_SPEC_CTRL shadow. This field contains the value that guest software expects to be in the 
IA32_SPEC_CTRL MSR. 


Section 26.3 discusses how these fields are used in VMX non-root operation. 


25.7. VM-EXIT CONTROL FIELDS 


The VM-exit control fields govern the behavior of VM exits. They are discussed in Section 25.7.1 and Section 
25.7.2. 


25.7.1 VM-Exit Controls 


The VM-exit controls constitute two vectors that govern the basic operation of VM exits. These are the primary 
VM-exit controls (32 bits) and the secondary VM-exits controls (64 bits). 


Table 25-13 lists the primary VM-exit controls. See Chapter 28 for complete details of how these controls affect 
VM exits. 


Table 25-13. Definitions of Primary VM-Exit Controls 


Bit Position(s) | Name Description 
2 Save debug controls This control determines whether DR7 and the I[A32_DEBUGCTL MSR are saved on 
VM exit. 


The first processors to support the virtual-machine extensions supported only the 1- 
setting of this control. 


9 Host address-space size On processors that support Intel 64 architecture, this control determines whether a 
logical processor is in 64-bit mode after the next VM exit. Its value is loaded into CS.L, 
IA32_EFER.LME, and |A32_EFER.LMA on every VM exit, 


This control must be O on processors that do not support Intel 64 architecture. 


12 Load This control determines whether the [A32_PERF_GLOBAL_CTRL MSR is loaded on 
IA32_PERF_GLOBAL_CTRL | VM exit. 

15 Acknowledge interrupt on | This control affects VM exits due to external interrupts: 
exit * If sucha VM exit occurs and this control is 1, the logical processor acknowledges the 


interrupt controller, acquiring the interrupt's vector. The vector is stored in the 
\V/M-exit interruption-information field, which is marked valid. 

* If sucha VM exit occurs and this control is 0, the interrupt is not acknowledged and 
the VM-exit interruption-information field is marked invalid. 


18 Save IA32_PAT This control determines whether the [A32_PAT MSR is saved on VM exit. 

19 Load IA32_PAT This control determines whether the [A32_PAT MSR is loaded on VM exit. 

20 Save IA32_EFER This control determines whether the [A32_EFER MSR is saved on VM exit. 

21 Load IA32_EFER This control determines whether the [A32_EFER MSR is loaded on VM exit. 

22 Save VMX-preemption This control determines whether the value of the VMX-preemption timer is saved on 
timer value VM exit. 

23 Clear IA32_BNDCFGS This control determines whether the [A32_BNDCFGS MSR is cleared on VM exit. 

24 Conceal VMX from PT If this control is 1, Intel Processor Trace does not produce a paging information packet 


(PIP) on a VM exit or a VMCS packet on an SMM VM exit (See Chapter 33). 
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Table 25-13. Definitions of Primary VM-Exit Controls (Contd.) 


Bit Position(s) | Name Description 

25 Clear IA32_RTIT_CTL This control determines whether the [A32_RTIT_CTL MSR is cleared on VM exit. 

26 Clear IA32_LBR_CTL This control determines whether the [A32_LBR_CTL MSR is cleared on VM exit. 

27 Clear UINV This control determines whether UINV is cleared on VM exit. 

28 Load CET state This control determines whether CET-related MSRs and SSP are loaded on VM exit. 

29 Load PKRS This control determines whether the [A32_PKRS MSR is loaded on VM exit. 

30 Save This control determines whether the [A32_PERF_GLOBAL_CTL MSR is saved on VM 
IA32_PERF_GLOBAL_CTL | exit. 

31 Activate secondary This control determines whether the secondary VM-exit controls are used. If this 
controls control is 0, the logical processor operates as if all the secondary VM-exit controls were 

also O. 
NOTES: 


1. Since the Intel 64 architecture specifies that |A32_EFER.LMA is always set to the logical-AND of CRO.PG and IA32_EFER.LME, and 
since CRO.PG is always 1 in VMX root operation, [A32_EFER.LMA is always identical to [IA32_EFER.LME in VMX root operation. 


All other bits in this field are reserved, some to 0 and some to 1. Software should consult the VMX capability MSRs 
IA32_VMX_EXIT_CTLS and IA32_VMX_TRUE_EXIT_CTLS (see Appendix A.4) to determine how it should set the 
reserved bits. Failure to set reserved bits properly causes subsequent VM entries to fail (see Section 27.2.1.2). 


The first processors to support the virtual-machine extensions supported only the 1-settings of bits 0-8, 10, 11, 
13, 14, 16, and 17. The VMX capability MSR IA32_VMX_EXIT_CTLS always reports that these bits must be 1. 
Logical processors that support the O-settings of any of these bits will support the VMX capability MSR IA32_VMX- 
_TRUE_EXIT_CTLS MSR, and software should consult this MSR to discover support for the 0-settings of these bits. 
Software that is not aware of the functionality of any one of these bits should set that bit to 1. 


Bit 31 of the primary processor-based VM-exit controls determines whether the secondary VM-exit controls are 
used. If that bit is 0, VM entries and VM exits function as if all the secondary VM-exit controls were 0. Processors 
that support only the O-setting of bit 31 of the primary VM-exit controls do not support the secondary VM-exit 
controls. 


Table 25-14 lists the secondary VM-exit controls. See Chapter 28 for more details of how these controls affect 
VM exits. 


Table 25-14. Definitions of Secondary VM-Exit Controls 


Bit Position(s) | Name Description 
3 Prematurely busy | If this control is 1, VM exits that cause a shadow stack to become prematurely busy (see 
shadow stack Section 17.2.3, “Supervisor Shadow Stack Token,” in the Intel® 64 and IA-32 Architectures 
Software Developer's Manual, Volume 1) indicate this fact and save additional information into 
the VMCS. 


All other bits in this field are reserved to 0. Software should consult the VMX capability MSR IA32_VMX_EX- 
IT_CTLS2 (see Appendix A.4.2) to determine which bits may be set to 1. Failure to clear reserved bits causes 
subsequent VM entries to fail (see Section 27.2.1.2). 


25.7.2 VM-Exit Controls for MSRs 


AVMM may specify lists of MSRs to be stored and loaded on VM exits. The following VM-exit control fields deter- 
mine how MSRs are stored on VM exits: 


¢ VM-exit MSR-store count (32 bits). This field specifies the number of MSRs to be stored on VM exit. It is 
recommended that this count not exceed 512.1 Otherwise, unpredictable processor behavior (including a 
machine check) may result during VM exit. 
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¢ VM-exit MSR-store address (64 bits). This field contains the physical address of the VM-exit MSR-store area. 
The area is a table of entries, 16 bytes per entry, where the number of entries is given by the VM-exit MSR- 
store count. The format of each entry is given in Table 25-15. If the VM-exit MSR-store count is not zero, the 
address must be 16-byte aligned. 


Table 25-15. Format of an MSR Entry 


Bit Position(s) Contents 
31:0 MSR index 
63:32 Reserved 
127:64 MSR data 


See Section 28.4 for how this area is used on VM exits. 
The following VM-exit control fields determine how MSRs are loaded on VM exits: 


¢ VM-exit MSR-load count (32 bits). This field contains the number of MSRs to be loaded on VM exit. It is 
recommended that this count not exceed 512. Otherwise, unpredictable processor behavior (including a 
machine check) may result during VM exit.? 


° VM-exit MSR-load address (64 bits). This field contains the physical address of the VM-exit MSR-load area. 
The area is a table of entries, 16 bytes per entry, where the number of entries is given by the VM-exit MSR-load 
count (see Table 25-15). If the VM-exit MSR-load count is not zero, the address must be 16-byte aligned. 


See Section 28.6 for how this area is used on VM exits. 


25.8 VM-ENTRY CONTROL FIELDS 


The VM-entry control fields govern the behavior of VM entries. They are discussed in Sections 25.8.1 through 
25.8.3. 


25.8.1 VM-Entry Controls 


The VM-entry controls constitute a 32-bit vector that governs the basic operation of VM entries. Table 25-16 lists 
the controls supported. See Chapter 25 for how these controls affect VM entries. 


Table 25-16. Definitions of VM-Entry Controls 


Bit Position(s) | Name Description 
2 Load debug This control determines whether DR7 and the IA32_DEBUGCTL MSR are loaded on VM entry. 
controls The first processors to support the virtual-machine extensions supported only the 1-setting of 
this control. 
9 IA-32e mode guest | On processors that support Intel 64 architecture, this control determines whether the logical 
processor is in |A-32e mode after VM entry. Its value is loaded into [A32_EFER.LMA as part of 
VM entry.! 


This control must be O on processors that do not support Intel 64 architecture. 


10 Entry to SMM This control determines whether the logical processor is in system-management mode (SMM) 
after VM entry. This control must be O for any VM entry from outside SMM. 


11 Deactivate dual- If set to 1, the default treatment of SMIs and SMM is in effect after the VM entry (see Section 
monitor treatment | 32.15.7). This control must be O for any VM entry from outside SMM. 


1. Future implementations may allow more MSRs to be stored reliably. Software should consult the VMX capability MSR 1IA32_VMX_- 
MISC to determine the number supported (see Appendix A.6). 


1. Future implementations may allow more MSRs to be loaded reliably. Software should consult the VMX capability MSR I[A32_VMX_- 
MISC to determine the number supported (see Appendix A.6). 
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Table 25-16. Definitions of VM-Entry Controls (Contd.) 


Bit Position(s) | Name Description 

13 Load This control determines whether the [A32_PERF_GLOBAL_CTRL MSR is loaded on VM entry. 
IA32_PERF_GLOBA 
L_CTRL 

14 Load IA32_PAT This control determines whether the [A32_PAT MSR is loaded on VM entry. 

15 Load IA32_EFER This control determines whether the [A32_EFER MSR is loaded on VM entry. 

16 Load This control determines whether the [A32_BNDCFGS MSR is loaded on VM entry. 
IA32_BNDCFGS 

17 Conceal VMX from _ | If this control is 1, Intel Processor Trace does not produce a paging information packet (PIP) on 
PT a VM entry or a VMCS packet on a VM entry that returns from SMM (see Chapter 33). 

18 Load This control determines whether the [A32_RTIT_CTL MSR is loaded on VM entry. 
IA32_RTIT_CTL 

19 Load UINV This control determines whether UINV is loaded on VM entry. 

20 Load CET state This control determines whether CET-related MSRs and SSP are loaded on VM entry. 

21 Load guest This control determines whether the [A32_LBR_CTL MSR is loaded on VM entry. 
IA32_LBR_CTL 

22 Load PKRS This control determines whether the [A32_PKRS MSR is loaded on VM entry. 

NOTES: 


1. Bit 5 of the IA32_VMX_MISC MSR is read as 1 on any logical processor that supports the 1-setting of the “unrestricted guest” VM- 
execution control. If it is read as 1, every VM exit stores the value of IA32_EFER.LMA into the “IA-32e mode quest” VM-entry control 
(see Section 28.2). 


All other bits in this field are reserved, some to 0 and some to 1. Software should consult the VMX capability MSRs 
IA32_VMX_ENTRY_CTLS and IA32_VMX_TRUE_ENTRY_CTLS (see Appendix A.5) to determine how it should set 
the reserved bits. Failure to set reserved bits properly causes subsequent VM entries to fail (see Section 27.2.1.3). 


The first processors to support the virtual-machine extensions supported only the 1-settings of bits O-8 and 12. 
The VMX capability MSR IA32_VMX_ENTRY_CTLS always reports that these bits must be 1. Logical processors that 
support the O-settings of any of these bits will support the VMX capability MSR IA32_VMX_TRUE_ENTRY_CTLS 
MSR, and software should consult this MSR to discover support for the O-settings of these bits. Software that is not 
aware of the functionality of any one of these bits should set that bit to 1. 


25.8.2 VM-Entry Controls for MSRs 


AVMM may specify a list of MSRs to be loaded on VM entries. The following VM-entry control fields manage this 

functionality: 

¢ VM-entry MSR-load count (32 bits). This field contains the number of MSRs to be loaded on VM entry. It is 
recommended that this count not exceed 512. Otherwise, unpredictable processor behavior (including a 
machine check) may result during VM entry. 

¢ VM-entry MSR-load address (64 bits). This field contains the physical address of the VM-entry MSR-load 
area. The area is a table of entries, 16 bytes per entry, where the number of entries is given by the VM-entry 
MSR-load count. The format of entries is described in Table 25-15. If the VM-entry MSR-load count is not zero, 
the address must be 16-byte aligned. 


See Section 27.4 for details of how this area is used on VM entries. 


25.8.3. VM-Entry Controls for Event Injection 


1. Future implementations may allow more MSRs to be loaded reliably. Software should consult the VMX capability MSR [A32_VMX_- 
MISC to determine the number supported (see Appendix A.6). 
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VM entry can be configured to conclude by delivering an event through the IDT (after all guest state and MSRs have 
been loaded). This process is called event injection and is controlled by the following three VM-entry control 
fields: 


¢ VM-entry interruption-information field (32 bits). This field provides details about the event to be injected. 
Table 25-17 describes the field. 


Table 25-17. Format of the VM-Entry Interruption-Information Field 
Bit Position(s) | Content 


7:0 Vector of interrupt or exception 
10:8 Interruption type: 

0: External interrupt 

1: Reserved 


2: Non-maskable interrupt (NMI) 

3: Hardware exception (e.g,. #PF) 

4: Software interrupt (INT n) 

5: Privileged software exception (INT1) 
6: Software exception (INT3 or INTO) 
7: Other event 


11 Deliver error code (0 = do not deliver; 1 = deliver) 
30:12 Reserved 
31 Valid 


— The vector (bits 7:0) determines which entry in the IDT is used or which other event is injected. 


— The interruption type (bits 10:8) determines details of how the injection is performed. In general, a VMM 
should use the type hardware exception for all exceptions other than the following: 


¢ breakpoint exceptions (#BP; a VMM should use the type software exception); 
* overflow exceptions (#OF a VMM should use the use type software exception); and 


¢ those debug exceptions (#DB) that are generated by INT1 (a VMM should use the use type privileged 
software exception). 


The type other event is used for injection of events that are not delivered through the IDT.2 


— For exceptions, the deliver-error-code bit (bit 11) determines whether delivery pushes an error code on 
the guest stack. 


— VM entry injects an event if and only if the valid bit (bit 31) is 1. The valid bit in this field is cleared on 
every VM exit (see Section 28.2). 


° VM-entry exception error code (32 bits). This field is used if and only if the valid bit (bit 31) and the deliver- 
error-code bit (bit 11) are both set in the VM-entry interruption-information field. 


¢ VM-entry instruction length (32 bits). For injection of events whose type is software interrupt, software 
exception, or privileged software exception, this field is used to determine the value of RIP that is pushed on 
the stack. 


See Section 27.6 for details regarding the mechanics of event injection, including the use of the interruption type 
and the VM-entry instruction length. 


VM exits clear the valid bit (bit 31) in the VM-entry interruption-information field. 


25.9 VM-EXIT INFORMATION FIELDS 


The VMCS contains a section of fields that contain information about the most recent VM exit. 


1. The type hardware exception should be used for all other debug exceptions. 
2. INT1 and INT3 refer to the instructions with opcodes F1 and CC, respectively, and not to INT n with values 1 or 3 for n. 
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On some processors, attempts to write to these fields with VMWRITE fail (see “VMWRITE—Write Field to Virtual- 
Machine Control Structure” in Chapter 31). 


25.9.1 


Basic VM-Exit Information 


The following VM-exit information fields provide basic information about a VM exit: 


¢ Exit reason (32 bits). This field encodes the reason for the VM exit and has the structure given in Table 25-18. 


Table 25-18. Format of Exit Reason 


Bit Position(s) Contents 

15:0 Basic exit reason. 

16 Always cleared to 0. 

24:17 Not currently defined. 

25 A VM exit saves this bit as 1 to indicate that the VM exit caused a shadow stack to become prematurely busy. 

26 AVM exit saves this bit as 1 to indicate that the VM exit occurred after assertion of a bus lock while the “VMM 
bus-lock detection” VM-execution control was 1. 

27 A VM exit saves this bit as 1 to indicate that the VM exit was incident to enclave mode. 

28 Pending MTF VM exit. 

29 VM exit from VMX root operation. 

30 Not currently defined. 

31 VM-entry failure (0 = true VM exit; 1 = VM-entry failure) 


Bits 15:0 provide basic information about the cause of the VM exit (if bit 31 is clear) or of the VM-entry 
failure (if bit 31 is set). Appendix C enumerates the basic exit reasons. 


Bit 16 is always cleared to 0. 


Bit 25 is set to 1 if the “prematurely busy shadow stack” VM-exit control is 1 and the VM exit caused a 
shadow stack to become prematurely busy (see Section 26.4.3). Otherwise, the bit is cleared. 


Bit 26 is set to 1 if the VM exit occurred after assertion of a bus lock while the “VMM bus-lock detection” VM- 
execution control was 1. Such VM exits include those that occur due to the 1-setting of that control as well 
as others that might occur during execution of an instruction that asserted a bus lock. 


Bit 27 is set to 1 if the VM exit occurred while the logical processor was in enclave mode. 


AVM exit also sets this bit if it is incident to delivery of an event injected by VM entry and the guest inter- 
ruptibility-state field indicates an enclave interrupt (bit 4 of the field is 1). See Section 28.2.1 for details. 


Bit 28 is set only by an SMM VM exit (see Section 32.15.2) that took priority over an MTF VM exit (see 
Section 26.5.2) that would have occurred had the SMM VM exit not occurred. See Section 32.15.2.3. 


Bit 29 is set if and only if the processor was in VMX root operation at the time the VM exit occurred. This can 
happen only for SMM VM exits. See Section 32.15.2. 


Because some VM-entry failures load processor state from the host-state area (see Section 27.8), software 
must be able to distinguish such cases from true VM exits. Bit 31 is used for that purpose. 


°  =Exit qualification (64 bits; 32 bits on processors that do not support Intel 64 architecture). This field contains 
additional information about the cause of VM exits due to the following: debug exceptions; page-fault 
exceptions; start-up IPIs (SIPIs); task switches; INVEPT; INVLPG;INVVPID; LGDT; LIDT; LLDT; LTR; SGDT; 
SIDT; SLDT; STR; VMCLEAR; VMPTRLD; VMPTRST; VMREAD; VMWRITE; VMXON; XRSTORS; XSAVES; control- 


1. Software can discover whether these fields can be written by reading the VMX capability MSR IA32_VMX_MISC (see Appendix A.6). 
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register accesses; MOV DR; I/O instructions; and MWAIT. The format of the field depends on the cause of the 


VM exit. See Section 28.2.1 for details. 


° Guest-linear address (64 bits; 32 bits on processors that do not support Intel 64 architecture). This field is 


used in the following cases: 
— VM exits due to attempts to execute LMSW with a memory operand. 
— VM exits due to attempts to execute INS or OUTS. 


— VM exits due to system-management interrupts (SMIs) that arrive immediately after retirement of I/O 


instructions. 
— Certain VM exits due to EPT violations 


See Section 28.2.1 and Section 32.15.2.3 for details of when and how this field is used. 


° Guest-physical address (64 bits). This field is used by VM exits due to EPT violations and EPT misconfigura- 


tions. See Section 28.2.1 for details of when and how this field is used. 


25.9.2 Information for VM Exits Due to Vectored Events 


Event-specific information is provided for VM exits due to the following vectored events: exceptions (including 
those generated by the instructions INT3, INTO, INT1, BOUND, UDO, UD1, and UD2); external interrupts that occur 
while the “acknowledge interrupt on exit” VM-exit control is 1; and non-maskable interrupts (NMIs). This informa- 


tion is provided in the following fields: 


° VM-exit interruption information (32 bits). This field receives basic information associated with the event 


causing the VM exit. Table 25-19 describes this field. 


Table 25-19. Format of the VM-Exit Interruption-Information Field 


Bit Position(s) | Content 


7:0 Vector of interrupt or exception 
10:8 Interruption type: 

0: External interrupt 

1: Not used 


2: Non-maskable interrupt (NMI) 
3: Hardware exception 

4: Not used 

5: Privileged software exception 
6: Software exception 


7: Not used 
11 Error code valid (0 = invalid; 1 = valid) 
12 NMI unblocking due to IRET 
30:13 Not currently defined 
31 Valid 


° VM-exit interruption error code (32 bits). For VM exits caused by hardware exceptions that would have 


delivered an error code on the stack, this field receives that error code. 
Section 28.2.2 provides details of how these fields are saved on VM exits. 


25.9.3. Information for VM Exits That Occur During Event Delivery 


Additional information is provided for VM exits that occur during event delivery in VMX non-root operation.! This 


information is provided in the following fields: 


1. This includes cases in which the event delivery was caused by event injection as part of VM entry; see Section 27.6.1.2. 
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¢ 1IDT-vectoring information (32 bits). This field receives basic information associated with the event that was 
being delivered when the VM exit occurred. Table 25-20 describes this field. 


Table 25-20. Format of the IDT-Vectoring Information Field 


Bit Position(s) | Content 


7:0 Vector of interrupt or exception 
10:8 Interruption type: 

0: External interrupt 

1: Not used 


2: Non-maskable interrupt (NMI) 
3: Hardware exception 

4: Software interrupt 

5: Privileged software exception 
6: Software exception 


7: Not used 
11 Error code valid (0 = invalid; 1 = valid) 
30:12 Not currently defined 
31 Valid 


¢ 1IDT-vectoring error code (32 bits). For VM exits the occur during delivery of hardware exceptions that would 
have delivered an error code on the stack, this field receives that error code. 


See Section 28.2.4 provides details of how these fields are saved on VM exits. 


25.9.4 Information for VM Exits Due to Instruction Execution 
The following fields are used for VM exits caused by attempts to execute certain instructions in VMX non-root oper- 
ation: 


¢ \VM-exit instruction length (32 bits). For VM exits resulting from instruction execution, this field receives the 
length in bytes of the instruction whose execution led to the VM exit. See Section 28.2.5 for details of when 
and how this field is used. 


° VM-exit instruction information (32 bits). This field is used for VM exits due to attempts to execute INS, 
INVEPT, INVVPID, LIDT, LGDT, LLDT, LTR, OUTS, SIDT, SGDT, SLDT, STR, VMCLEAR, VMPTRLD, VMPTRST, 
VMREAD, VMWRITE, or VMXON.2 The format of the field depends on the cause of the VM exit. See Section 
28.2.5 for details. 


The following fields (64 bits each; 32 bits on processors that do not support Intel 64 architecture) are used only for 
VM exits due to SMIs that arrive immediately after retirement of I/O instructions. They provide information about 
that I/O instruction: 


¢ I/O RCX. The value of RCX before the I/O instruction started. 

¢ I/O RSI. The value of RSI before the I/O instruction started. 

¢ I/O RDI. The value of RDI before the I/O instruction started. 

° I/O RIP. The value of RIP before the I/O instruction started (the RIP that addressed the I/O instruction). 


1. This field is also used for VM exits that occur during the delivery of a software interrupt or software exception. 


2. Whether the processor provides this information on VM exits due to attempts to execute INS or OUTS can be determined by consult- 
ing the VMX capability MSR IA32_VMX_BASIC (see Appendix A.1). 
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25.9.5 \VM-Instruction Error Field 


The 32-bit VM-instruction error field does not provide information about the most recent VM exit. In fact, it is 
not modified on VM exits. Instead, it provides information about errors encountered by a non-faulting execution of 
one of the VMX instructions. 


25.10 VMCS TYPES: ORDINARY AND SHADOW 


Every VMCS is either an ordinary VMCS or a shadow VMCS. A VMCS'’s type is determined by the shadow-VMCS 
indicator in the VMCS region (this is the value of bit 31 of the first 4 bytes of the VMCS region; see Table 25-1): 0 
indicates an ordinary VMCS, while 1 indicates a shadow VMCS. Shadow VMCSs are supported only on processors 
that support the 1-setting of the “VMCS shadowing” VM-execution control (see Section 25.6.2). 


A shadow VMCS differs from an ordinary VMCS in two ways: 


¢ Anordinary VMCS can be used for VM entry but a shadow VMCS cannot. Attempts to perform VM entry when 
the current VMCS is a shadow VMCS fail (see Section 27.1). 


¢ The VMREAD and VMWRITE instructions can be used in VMX non-root operation to access a shadow VMCS but 
not an ordinary VMCS. This fact results from the following: 


— Ifthe“VMCS shadowing” VM-execution control is 0, execution of the VMREAD and VMWRITE instructions in 
VMX non-root operation always cause VM exits (see Section 26.1.3). 


— Ifthe “VMCS shadowing” VM-execution control is 1, execution of the VMREAD and VMWRITE instructions in 
VMX non-root operation can access the VMCS referenced by the VMCS link pointer (see Section 31.3). 


— If the“VMCS shadowing” VM-execution control is 1, VM entry ensures that any VMCS referenced by the 
VMCS link pointer is a shadow VMCS (see Section 27.3.1.5). 


In VMX root operation, both types of VMCSs can be accessed with the VMREAD and VMWRITE instructions. 


Software should not modify the shadow-VMCS indicator in the VMCS region of a VMCS that is active. Doing so may 
cause the VMCS to become corrupted (see Section 25.11.1). Before modifying the shadow-VMCS indicator, soft- 
ware should execute VMCLEAR for the VMCS to ensure that it is not active. 


25.11 SOFTWARE USE OF THE VMCS AND RELATED STRUCTURES 


This section details guidelines that software should observe when using a VMCS and related structures. It also 
provides descriptions of consequences for failing to follow guidelines. 


25.11.1 Software Use of Virtual-Machine Control Structures 
To ensure proper processor behavior, software should observe certain guidelines when using an active VMCS. 


No VMCS should ever be active on more than one logical processor. If a VMCS is to be “migrated” from one logical 
processor to another, the first logical processor should execute VMCLEAR for the VMCS (to make it inactive on that 
logical processor and to ensure that all VMCS data are in memory) before the other logical processor executes 
VMPTRLD for the VMCS (to make it active on the second logical processor).! A VMCS that is made active on more 
than one logical processor may become corrupted (see below). 


Software should not modify the shadow-VMCS indicator (see Table 25-1) in the VMCS region of a VMCS that is 
active. Doing so may cause the VMCS to become corrupted. Before modifying the shadow-VMCS indicator, software 
should execute VMCLEAR for the VMCS to ensure that it is not active. 


Software should use the VMREAD and VMWRITE instructions to access the different fields in the current VMCS (see 
Section 25.11.2). Software should never access or modify the VMCS data of an active VMCS using ordinary 


1. As noted in Section 25.1, execution of the VMPTRLD instruction makes a VMCS is active. In addition, VM entry makes active any 
shadow VMCS referenced by the VMCS link pointer in the current VMCS. If a shadow VMCS is made active by VM entry, it is neces- 
sary to execute VMCLEAR for that VMCS before allowing that VMCS to become active on another logical processor. 
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memory operations, in part because the format used to store the VMCS data is implementation-specific and not 
architecturally defined, and also because a logical processor may maintain some VMCS data of an active VMCS on 
the processor and not in the VMCS region. The following items detail some of the hazards of accessing VMCS data 
using ordinary memory operations: 


e Any data read from a VMCS with an ordinary memory read does not reliably reflect the state of the VMCS. 
Results may vary from time to time or from logical processor to logical processor. 


¢* Writing to a VMCS with an ordinary memory write is not guaranteed to have a deterministic effect on the VMCS. 
Doing so may cause the VMCS to become corrupted (see below). 


(Software can avoid these hazards by removing any linear-address mappings to a VMCS region before executing a 
VMPTRLD for that region and by not remapping it until after executing VMCLEAR for that region.) 


If a logical processor leaves VMX operation, any VMCSs active on that logical processor may be corrupted (see 
below). To prevent such corruption of a VMCS that may be used either after a return to VMX operation or on 
another logical processor, software should execute VMCLEAR for that VMCS before executing the VMXOFF instruc- 
tion or removing power from the processor (e.g., as part of a transition to the S3 and S4 power states). 


This section has identified operations that may cause a VMCS to become corrupted. These operations may cause 
the VMCS's data to become undefined. Behavior may be unpredictable if that VMCS used subsequently on any 
logical processor. The following items detail some hazards of VMCS corruption: 


¢ VM entries may fail for unexplained reasons or may load undesired processor state. 


¢ The processor may not correctly support VMX non-root operation as documented in Chapter 26 and may 
generate unexpected VM exits. 


e VM exits may load undesired processor state, save incorrect state into the VMCS, or cause the logical processor 
to transition to a shutdown state. 


25.11.2 VMREAD, VMWRITE, and Encodings of VMCS Fields 


Every field of the VMCS is associated with a 32-bit value that is its encoding. The encoding is provided in an 
operand to VMREAD and VMWRITE when software wishes to read or write that field. These instructions fail if given, 
in 64-bit mode, an operand that sets an encoding bit beyond bit 32. See Chapter 31 for a description of these 
instructions. 


The structure of the 32-bit encodings of the VMCS components is determined principally by the width of the fields 
and their function in the VMCS. See Table 25-21. 


Table 25-21. Structure of VMCS Component Encoding 


Bit Position(s) Contents 
0 Access type (0 = full; 1 = high); must be full for 16-bit, 32-bit, and natural-width fields 
9:1 Index 
11:10 Type: 
0: control 


1: VM-exit information 
2: guest state 
3: host state 


12 Reserved (must be 0) 
14:13 Width: 

0: 16-bit 

1: 64-bit 

2: 32-bit 


3: natural-width 


31:15 Reserved (must be 0) 


25-30 Vol. 3C 


VIRTUAL MACHINE CONTROL STRUCTURES 


The following items detail the meaning of the bits in each encoding: 


Field width. Bits 14:13 encode the width of the field. 
— A value of 0 indicates a 16-bit field. 
— A value of 1 indicates a 64-bit field. 
— A value of 2 indicates a 32-bit field. 


— A value of 3 indicates a natural-width field. Such fields have 64 bits on processors that support Intel 64 
architecture and 32 bits on processors that do not. 


Fields whose encodings use value 1 are specially treated to allow 32-bit software access to all 64 bits of the 
field. Such access is allowed by defining, for each such field, an encoding that allows direct access to the high 
32 bits of the field. See below. 


Field type. Bits 11:10 encode the type of VMCS field: control, guest-state, host-state, or VM-exit information. 
(The last category also includes the VM-instruction error field. ) 


Index. Bits 9:1 distinguish components with the same field width and type. 


Access type. Bit 0 must be 0 for all fields except for 64-bit fields (those with field-width 1; see above). A 
VMREAD or VMWRITE using an encoding with this bit cleared to 0 accesses the entire field. For a 64-bit field 
with field-width 1,a VMREAD or VMWRITE using an encoding with this bit set to 1 accesses only the high 32 bits 
of the field. 


Appendix B gives the encodings of all fields in the VMCS. 


The following describes the operation of VMREAD and VMWRITE based on processor mode, VMCS-field width, and 
access type: 


16-bit fields: 


— AVMREAD returns the value of the field in bits 15:0 of the destination operand; other bits of the destination 
operand are cleared to 0. 


— AVMWRITE writes the value of bits 15:0 of the source operand into the VMCS field; other bits of the source 
operand are not used. 


32-bit fields: 


— AVMREAD returns the value of the field in bits 31:0 of the destination operand; in 64-bit mode, bits 63:32 
of the destination operand are cleared to 0. 


— AVMWRITE writes the value of bits 31:0 of the source operand into the VMCS field; in 64-bit mode, 
bits 63:32 of the source operand are not used. 


64-bit fields and natural-width fields using the full access type outside IA-32e mode. 


— AVMREAD returns the value of bits 31:0 of the field in its destination operand; bits 63:32 of the field are 
ignored. 


— AVMWRITE writes the value of its source operand to bits 31:0 of the field and clears bits 63:32 of the field. 


64-bit fields and natural-width fields using the full access type in 64-bit mode (only on processors that support 
Intel 64 architecture). 


— AVMREAD returns the value of the field in bits 63:0 of the destination operand 
— AVMWRITE writes the value of bits 63:0 of the source operand into the VMCS field. 
64-bit fields using the high access type. 


— AVMREAD returns the value of bits 63:32 of the field in bits 31:0 of the destination operand; in 64-bit 
mode, bits 63:32 of the destination operand are cleared to 0. 


— AVMWRITE writes the value of bits 31:0 of the source operand to bits 63:32 of the field; in 64-bit mode, 
bits 63:32 of the source operand are not used. 


Software seeking to read a 64-bit field outside IA-32e mode can use VMREAD with the full access type (reading 
bits 31:0 of the field) and VMREAD with the high access type (reading bits 63:32 of the field); the order of the two 
VMREAD executions is not important. Software seeking to modify a 64-bit field outside IA-32e mode should first 
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use VMWRITE with the full access type (establishing bits 31:0 of the field while clearing bits 63:32) and then use 
VMWRITE with the high access type (establishing bits 63:32 of the field). 


25.11.3 Initializing a VMCS 


Software should initialize fields in a VMCS (using VMWRITE) before using the VMCS for VM entry. Failure to do so 
may result in unpredictable behavior; for example, a VM entry may fail for unexplained reasons, or a successful 
transition (VM entry or VM exit) may load processor state with unexpected values. 


It is not necessary to initialize fields that the logical processor will not use. (For example, it is not necessary to 
initialize the MSR-bitmap address if the “use MSR bitmaps” VM-execution control is 0.) 


A processor maintains some VMCS information that cannot be modified with the VMWRITE instruction; this includes 
a VMCS’s launch state (see Section 25.1). Such information may be stored in the VMCS data portion of a VMCS 
region. Because the format of this information is implementation-specific, there is no way for software to know, 
when it first allocates a region of memory for use as a VMCS region, how the processor will determine this informa- 
tion from the contents of the memory region. 


In addition to its other functions, the VMCLEAR instruction initializes any implementation-specific information in the 
VMCS region referenced by its operand. To avoid the uncertainties of implementation-specific behavior, software 
should execute VMCLEAR on a VMCS region before making the corresponding VMCS active with VMPTRLD for the 
first time. (Figure 25-1 illustrates how execution of VMCLEAR puts a VMCS into a well-defined state. ) 


The following software usage is consistent with these limitations: 
® VMCLEAR should be executed for a VMCS before it is used for VM entry for the first time. 


¢ VMLAUNCH should be used for the first VM entry using a VMCS after VMCLEAR has been executed for that 
VMCS. 


¢ VMRESUME should be used for any subsequent VM entry using a VMCS (until the next execution of VMCLEAR 
for the VMCS). 


It is expected that, in general, VMRESUME will have lower latency than VMLAUNCH. Since “migrating” a VMCS from 
one logical processor to another requires use of VMCLEAR (see Section 25.11.1), which sets the launch state of the 
VMCS to “clear”, such migration requires the next VM entry to be performed using VMLAUNCH. Software devel- 
opers can avoid the performance cost of increased VM-entry latency by avoiding unnecessary migration of a VMCS 
from one logical processor to another. 


25.11.4 Software Access to Related Structures 


In addition to data in the VMCS region itself, VMX non-root operation can be controlled by data structures that are 
referenced by pointers in a VMCS (for example, the I/O bitmaps). While the pointers to these data structures are 
parts of the VMCS, the data structures themselves are not. They are not accessible using VMREAD and VMWRITE 
but by ordinary memory writes. 


Software should ensure that each such data structure is modified only when no logical processor with a current 
VMCS that references it is in VMX non-root operation. Doing otherwise may lead to unpredictable behavior 
(including behaviors identified in Section 25.11.1). Exceptions are made for the following data structures (subject 
to detailed discussion in the sections indicated): EPT paging structures and the data structures used to locate SPP 
vectors (Section 29.4.3); the virtual-APIC page (Section 30.1); the posted interrupt descriptor (Section 30.6); and 
the virtualization-exception information area (Section 26.5.7.2). 


25.11.5 VMXON Region 


Before executing VMXON, software allocates a region of memory (called the VMXON region)! that the logical 
processor uses to support VMX operation. The physical address of this region (the VMXON pointer) is provided in an 
operand to VMXON. The VMXON pointer is subject to the limitations that apply to VMCS pointers: 


1. The amount of memory required for the VMXON region is the same as that required for a VMCS region. This size is implementation 
specific and can be determined by consulting the VMX capability MSR I[A32_VMX_BASIC (see Appendix A.1). 
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¢ The VMXON pointer must be 4-KByte aligned (bits 11:0 must be zero). 
* The VMXON pointer must not set any bits beyond the processor’s physical-address width. !’2 


Before executing VMXON, software should write the VMCS revision identifier (see Section 25.2) to the VMXON 
region. (Specifically, it should write the 31-bit VMCS revision identifier to bits 30:0 of the first 4 bytes of the 
VMXON region; bit 31 should be cleared to 0.) It need not initialize the VMXON region in any other way. Software 
should use a separate region for each logical processor and should not access or modify the VMXON region of a 
logical processor between execution of VMXON and VMXOFF on that logical processor. Doing otherwise may lead to 
unpredictable behavior (including behaviors identified in Section 25.11.1). 


1. Software can determine a processor's physical-address width by executing CPUID with 8OOOO0O08H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


2. If IA32_VMX_BASIC[48] is read as 1, the VMXON pointer must not set any bits in the range 63:32; see Appendix A.1. 
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16.Updates to Chapter 27, Volume 3C 


Change bars and violet text show changes to Chapter 27 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3C: System Programming Guide, Part 3. 


Changes to this chapter: 


e Added information regarding user interrupts to Section 27.3.21, “Loading Guest Control Registers, Debug 
Registers, and MSRs.” 
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CHAPTER 27 
VM ENTRIES 


Software can enter VMX non-root operation using either of the VM-entry instructions VMLAUNCH and VMRESUME. 
VMLAUNCH can be used only with a VMCS whose launch state is clear and VMRESUME can be used only with a 
VMCS whose the launch state is launched. VMLAUNCH should be used for the first VM entry after VMCLEAR; VMRE- 
SUME should be used for subsequent VM entries with the same VMCS. 


Each VM entry performs the following steps in the order indicated: 
1. Basic checks are performed to ensure that VM entry can commence (Section 27.1). 


2. The control and host-state areas of the VMCS are checked to ensure that they are proper for supporting VMX 
non-root operation and that the VMCS is correctly configured to support the next VM exit (Section 27.2). 


3. The following may be performed in parallel or in any order (Section 27.3): 


° The guest-state area of the VMCS is checked to ensure that, after the VM entry completes, the state of the 
logical processor is consistent with IA-32 and Intel 64 architectures. 


¢ Processor state is loaded from the guest-state area and based on controls in the VMCS. 
e Address-range monitoring is cleared. 
MSRs are loaded from the VM-entry MSR-load area (Section 27.4). 

5. If VMLAUNCH is being executed, the launch state of the VMCS is set to “launched.” 


If the “Intel PT uses guest physical addresses” VM-execution control is 1, trace-address pre-translation (TAPT) 
may occur (see Section 26.5.4 and Section 27.5). 


7. An event may be injected in the guest context (Section 27.6). 


Steps 1-4 above perform checks that may cause VM entry to fail. Such failures occur in one of the following three 
ways: 


¢ Some of the checks in Section 27.1 may generate ordinary faults (for example, an invalid-opcode exception). 
Such faults are delivered normally. 


¢ Some of the checks in Section 27.1 and all the checks in Section 27.2 cause control to pass to the instruction 
following the VM-entry instruction. The failure is indicated by setting RFLAGS.ZF! (if there is a current VMCS) 
or RFLAGS.CF (if there is no current VMCS). If there is a current VMCS, an error number indicating the cause of 
the failure is stored in the VM-instruction error field. See Chapter 31 for the error numbers. 


° The checks in Section 27.3 and Section 27.4 cause processor state to be loaded from the host-state area of the 
VMCS (as would be done on a VM exit). Information about the failure is stored in the VM-exit information fields. 
See Section 27.8 for details. 


EFLAGS.TF = 1 causes a VM-entry instruction to generate a single-step debug exception only if failure of one of the 
checks in Section 27.1 and Section 27.2 causes control to pass to the following instruction. A VM-entry does not 
generate a single-step debug exception in any of the following cases: (1) the instruction generates a fault; (2) 
failure of one of the checks in Section 27.3 or in loading MSRs causes processor state to be loaded from the host- 
state area of the VMCS; or (3) the instruction passes all checks in Section 27.1, Section 27.2, and Section 27.3 and 
there is no failure in loading MSRs. 


Section 32.15 describes the dual-monitor treatment of system-management interrupts (SMIs) and system- 
management mode (SMM). Under this treatment, code running in SMM returns using VM entries instead of the RSM 
instruction. A VM entry returns from SMM if it is executed in SMM and the “entry to SMM” VM-entry control is 0. 
VM entries that return from SMM differ from ordinary VM entries in ways that are detailed in Section 32.15.4. 


1. This chapter uses the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that support VMX oper- 
ation also support Intel 64 architecture. For IA-32 processors, this notation refers to the 32-bit forms of those registers (EAX, EIP, 
ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer specifically to lower 32 bits of the indicated register. 
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27.1 BASIC VM-ENTRY CHECKS 


Before a VM entry commences, the current state of the logical processor is checked in the following order: 


1. If the logical processor is in virtual-8086 mode or compatibility mode, an invalid-opcode exception is 
generated. 


If the current privilege level (CPL) is not zero, a general-protection exception is generated. 
If there is no current VMCS, RFLAGS.CF is set to 1 and control passes to the next instruction. 


If there is a current VMCS but the current VMCS is a shadow VMCS (see Section 25.10), RFLAGS.CF is set to 1 
and control passes to the next instruction. 


5. If there is a current VMCS that is not a shadow VMCS, the following conditions are evaluated in order; any of 
these cause VM entry to fail: 


a. If there is MOV-SS blocking (see Table 25-3). 
b. Ifthe VM entry is invoked by VMLAUNCH and the VMCS launch state is not clear. 
c. Ifthe VM entry is invoked by VMRESUME and the VMCS launch state is not launched. 


If any of these checks fail, RFLAGS.ZF is set to 1 and control passes to the next instruction. An error number 
indicating the cause of the failure is stored in the VM-instruction error field. See Chapter 31 for the error 
numbers. 


27.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA 


If the checks in Section 27.1 do not cause VM entry to fail, the control and host-state areas of the VMCS are 
checked to ensure that they are proper for supporting VMX non-root operation, that the VMCS is correctly config- 
ured to support the next VM exit, and that, after the next VM exit, the processor’s state is consistent with the Intel 
64 and IA-32 architectures. 


VM entry fails if any of these checks fail. When such failures occur, control is passed to the next instruction, 
RFLAGS.ZF is set to 1 to indicate the failure, and the VM-instruction error field is loaded with an error number that 
indicates whether the failure was due to the controls or the host-state area (see Chapter 31). 


These checks may be performed in any order. Thus, an indication by error number of one cause (for example, host 
state) does not imply that there are not also other errors. Different processors may thus give different error 
numbers for the same VMCS. Some checks prevent establishment of settings (or combinations of settings) that are 
currently reserved. Future processors may allow such settings (or combinations) and may not perform the corre- 
sponding checks. The correctness of software should not rely on VM-entry failures resulting from the checks docu- 
mented in this section. 


The checks on the controls and the host-state area are presented in Section 27.2.1 through Section 27.2.4. These 
sections reference VMCS fields that correspond to processor state. Unless otherwise stated, these references are to 
fields in the host-state area. 


27.2.1 Checks on VMX Controls 


This section identifies VM-entry checks on the VMX control fields. 


27.2.1.1 VM-Execution Control Fields 


VM entries perform the following checks on the VM-execution control fields:? 


¢ Reserved bits in the pin-based VM-execution controls must be set properly. Software may consult the VMX 
capability MSRs to determine the proper settings (see Appendix A.3.1). 


1. If the “activate secondary controls” primary processor-based VM-execution control is 0, VM entry operates as if each secondary pro- 
cessor-based VM-execution control were 0. Similarly, if the “activate tertiary controls” primary processor-based VM-execution con- 
trol is O, VM entry operates as if each tertiary processor-based VM-execution control were 0. See Section 25.6.2. 
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Reserved bits in the primary processor-based VM-execution controls must be set properly. Software may 
consult the VMX capability MSRs to determine the proper settings (see Appendix A.3.2). 


If the “activate secondary controls” primary processor-based VM-execution control is 1, reserved bits in the 
secondary processor-based VM-execution controls must be cleared. Software may consult the VMX capability 
MSRs to determine which bits are reserved (see Appendix A.3.3). 


If the “activate secondary controls” primary processor-based VM-execution control is 0 (or if the processor 
does not support the 1-setting of that control), no checks are performed on the secondary processor-based 
VM-execution controls. The logical processor operates as if all the secondary processor-based VM-execution 
controls were 0. 


If the “activate tertiary controls” primary processor-based VM-execution control is 1, reserved bits in the 
tertiary processor-based VM-execution controls must be cleared. Software may consult the VMX capability 
MSRs to determine which bits are reserved (see Appendix A.3.4). 


If the “activate tertiary controls” primary processor-based VM-execution control is 0 (or if the processor does 
not support the 1-setting of that control), no checks are performed on the tertiary processor-based VM- 
execution controls. The logical processor operates as if all the tertiary processor-based VM-execution controls 
were 0. 


The CR3-target count must not be greater than 4. Future processors may support a different number of CR3- 
target values. Software should read the VMX capability MSR IA32_VMX_MISC to determine the number of 
values supported (see Appendix A.6). 


If the “use I/O bitmaps” VM-execution control is 1, bits 11:0 of each I/O-bitmap address must be 0. Neither 
address should set any bits beyond the processor’s physical-address width. !2 


If the “use MSR bitmaps” VM-execution control is 1, bits 11:0 of the MSR-bitmap address must be 0. The 
address should not set any bits beyond the processor’s physical-address width. 


If the “use TPR shadow” VM-execution control is 1, the virtual-APIC address must satisfy the following checks: 
— Bits 11:0 of the address must be 0. 
— The address should not set any bits beyond the processor’s physical-address width.4 


If all of the above checks are satisfied and the “use TPR shadow” VM-execution control is 1, bytes 3:1 of VTPR 
(see Section 30.1.1) may be cleared (behavior may be implementation-specific). 


The clearing of these bytes may occur even if the VM entry fails. This is true either if the failure causes control 
to pass to the instruction following the VM-entry instruction or if it causes processor state to be loaded from 
the host-state area of the VMCS. 


If the “use TPR shadow” VM-execution control is 1 and the “virtual-interrupt delivery” VM-execution control is 
0, bits 31:4 of the TPR threshold VM-execution control field must be 0. 


The following check is performed if the “use TPR shadow” VM-execution control is 1 and the “virtualize APIC 
accesses” and “virtual-interrupt delivery” VM-execution controls are both 0: the value of bits 3:0 of the TPR 
threshold VM-execution control field should not be greater than the value of bits 7:4 of VTPR (see Section 
30.1.1). 


If the “NMI exiting” VM-execution control is 0, the “virtual NMIs” VM-execution control must be 0. 
If the “virtual NMIs” VM-execution control is 0, the “NMI-window exiting” VM-execution control must be 0. 


If the “virtualize APIC-accesses” VM-execution control is 1, the APIC-access address must satisfy the following 
checks: 


— Bits 11:0 of the address must be 0. 
— The address should not set any bits beyond the processor’s physical-address width.° 


uk wn 


Software can determine a processor's physical-address width by executing CPUID with BOOOO008H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


If 1A32_VMX_BASIC[48] is read as 1, these addresses must not set any bits in the range 63:32; see Appendix A.1. 
If 1A32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1. 
If 1A32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1. 
If 1A32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1. 
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If the “use TPR shadow” VM-execution control is 0, the following VM-execution controls must also be 0: 
“virtualize x2APIC mode”, “APIC-register virtualization”, “virtual-interrupt delivery”, and “IPI virtualization”. 


If the “virtualize x2APIC mode” VM-execution control is 1, the “virtualize APIC accesses” VM-execution control 
must be 0. 


If the “virtual-interrupt delivery” VM-execution control is 1, the “external-interrupt exiting” VM-execution 
control must be 1. 


If the “process posted interrupts” VM-execution control is 1, the following must be true: 

— The “virtual-interrupt delivery” VM-execution control is 1. 

— The “acknowledge interrupt on exit” VM-exit control is 1. 

— The posted-interrupt notification vector has a value in the range 0-255 (bits 15:8 are all 0). 
— Bits 5:0 of the posted-interrupt descriptor address are all 0. 


— The po tea nee une descriptor address does not set any bits beyond the processor's physical-address 
width. 


If the “IPI virtualization” VM-execution control is 1, the following must be true: 
— Bits 2:0 of the PID-pointer table address are all 0. 
— The PID-pointer table address does not set any bits beyond the processor’s physical-address width. 


— The address of the last entry in the PID-pointer table does not set any bits beyond the processor’s physical- 
address width. (This address is the PID-pointer table address plus 8 times the last PID-pointer index.) 


If the “enable VPID” VM-execution control is 1, the value of the VPID VM-execution control field must not be 
OOOOH. 


If the “enable EPT” VM-execution control is 1, the EPTP VM-execution control field (see Table 25-9 in Section 
25.6.11) must satisfy the following checks: 


— The EPT memory type (bits 2:0) must be a value supported by the processor as indicated in the 
IA32_VMX_EPT_VPID_CAP MSR (see Appendix A.10). 


— Bits 5:3 must contain a value 1 less than an EPT page-walk length supported by the processor as indicated 
in the IA32_VMX_EPT_VPID_CAP MSR (see Section 29.3.2 and Appendix A.10). 


— Bit 6 (enable bit for accessed and dirty flags for EPT) must be 0 if bit 21 of the IA32_VMX_EPT_VPID_CAP 
MSR (see Appendix A.10) is read as 0, indicating that the processor does not support accessed and dirty 
flags for EPT. 


— Reserved bits 11:7 and 63:N (where N is the processor’s physical-address width) must all be 0. 


The “enable EPT” VM-execution control must be 1 if any of the following VM-execution controls is 1: “enable 
PML,” “unrestricted guest,” “mode-based execute control for EPT,” “sub-page write permissions for EPT,” “Intel 
PT uses guest physical addresses,” “enable HLAT,” “EPT paging-write control,” or “guest-paging verification.” 


If the “enable PML” VM-execution control is 1, the PML address must satisfy the following checks: 
— Bits 11:0 of the address must be 0. 
— The address should not set any bits beyond the processor’s physical-address width. 


If the “sub-page write permissions for EPT” VM-execution control is 1, the SPPTP VM-execution control field 
(see Table 25-11 in Section 25.6.22) must satisfy the following checks: 


— Bits 11:0 of the address must be 0. 
— The address should not set any bits beyond the processor’s physical-address width. 


If the “enable VM functions” processor-based VM-execution control is 1, reserved bits in the VM-function 
controls must be clear. Software may consult the VMX capability MSRs to determine which bits are reserved 
(see Appendix A.11). In addition, the following check is performed based on the setting of bits in the VM- 
function controls (see Section 25.6.14): 


1. 


If [A32_VMX_BASIC[48] is read as 1, this address must not set any bits in the range 63:32; see Appendix A.1. 
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— If“EPTP switching” VM-function control is 1, the “enable EPT” VM-execution control must also be 1. In 
addition, the EPTP-list address must satisfy the following checks: 


¢ Bits 11:0 of the address must be 0. 
¢ The address must not set any bits beyond the processor’s physical-address width. 


If the “enable VM functions” processor-based VM-execution control is 0, no checks are performed on the VM- 
function controls. 


If the “VMCS shadowing” VM-execution control is 1, the VMREAD-bitmap and VMWRITE-bitmap addresses 
must each satisfy the following checks: 


— Bits 11:0 of the address must be 0. 
— The address must not set any bits beyond the processor’s physical-address width. 


If the “EPT-violation #VE” VM-execution control is 1, the virtualization-exception information address must 
satisfy the following checks: 


— Bits 11:0 of the address must be 0. 
— The address must not set any bits beyond the processor’s physical-address width. 


If the logical processor is operating with Intel PT enabled (if IA32_RTIT_CTL.TraceEn = 1) at the time of 
VM entry, the “load IA32_RTIT_CTL” VM-entry control must be 0. 


If the “Intel PT uses guest physical addresses” VM-execution control is 1, the “load IA32_RTIT_CTL” VM-entry 
control and the “clear IA32_RTIT_CTL” VM-exit control must both be 1. 


If the “use TSC scaling” VM-execution control is 1, the TSC-multiplier must not be zero. 


If the “enable HLAT” VM-execution control is 1, the following bits in the HLATP VM-execution control field (see 
Table 25-12 in Section 25.6.23) must be zero: bits 2:0, bits 11:5, and bits beyond the processor’s physical- 
address width. 


If the “PASID translation” VM-execution control is 1, the low PASID directory address and the high PASID 
directory address must each satisfy the following checks: 


— Bits 11:0 of the address must be 0. 
— The address must not set any bits beyond the processor’s physical-address width. 


27.2.1.2 \VM-Exit Control Fields 


VM entries perform the following checks on the VM-exit control fields. 


Reserved bits in the primary VM-exit controls must be set properly. Software may consult the VMX capability 
MSRs to determine the proper settings (see Appendix A.4.1). 


If the “activate secondary controls” primary VM-exit control is 1, reserved bits in the secondary VM-exit 
controls must be cleared. Software may consult the VMX capability MSRs to determine which bits are reserved 
(see Appendix A.4.2). 


If the “activate secondary controls” primary VM-exit control is 0 (or if the processor does not support the 1- 
setting of that control), no checks are performed on the secondary VM-exit controls. The logical processor 
operates as if all the secondary VM-exit controls were 0. 


If the “activate VMX-preemption timer” VM-execution control is 0, the “save VMX-preemption timer value” VM- 
exit control must also be 0. 


The following checks are performed for the VM-exit MSR-store address if the VM-exit MSR-store count field is 
non-zero: 


— The lower 4 bits of the VM-exit MSR-store address must be 0. The address should not set any bits beyond 
the processor’s physical-address width.? 


. Software can determine a processor's physical-address width by executing CPUID with 8OOOOO0O8H in EAX. The physical-address 


width is returned in bits 7:0 of EAX. 
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— The address of the last byte in the VM-exit MSR-store area should not set any bits beyond the processor’s 
physical-address width. The address of this last byte is VM-exit MSR-store address + (MSR count * 16) - 1. 
(The arithmetic used for the computation uses more bits than the processor’s physical-address width. ) 


If IA32_VMX_BASIC[48] is read as 1, neither address should set any bits in the range 63:32; see Appendix 
A.1. 


The following checks are performed for the VM-exit MSR-load address if the VM-exit MSR-load count field is 
non-zero: 


— The lower 4 bits of the VM-exit MSR-load address must be 0. The address should not set any bits beyond 
the processor’s physical-address width. 


— The address of the last byte in the VM-exit MSR-load area should not set any bits beyond the processor’s 
physical-address width. The address of this last byte is VM-exit MSR-load address + (MSR count * 16) - 1. 
(The arithmetic used for the computation uses more bits than the processor’s physical-address width. ) 


If IA32_VMX_BASIC[48] is read as 1, neither address should set any bits in the range 63:32; see Appendix 
A.1. 


27.2.1.3. \VM-Entry Control Fields 


VM entries perform the following checks on the VM-entry control fields. 


Reserved bits in the VM-entry controls must be set properly. Software may consult the VMX capability MSRs to 
determine the proper settings (see Appendix A.5). 


Fields relevant to VM-entry event injection must be set properly. These fields are the VM-entry interruption- 
information field (see Table 25-17 in Section 25.8.3), the VM-entry exception error code, and the VM-entry 
instruction length. If the valid bit (bit 31) in the VM-entry interruption-information field is 1, the following must 
hold: 


— The field’s interruption type (bits 10:8) is not set to a reserved value. Value 1 is reserved on all logical 
processors; value 7 (other event) is reserved on logical processors that do not support the 1-setting of the 
“monitor trap flag” VM-execution control. 


— The field’s vector (bits 7:0) is consistent with the interruption type: 
¢ If the interruption type is non-maskable interrupt (NMI), the vector is 2. 
¢ If the interruption type is hardware exception, the vector is at most 31. 
¢ If the interruption type is other event, the vector is 0 (pending MTF VM exit). 


— The field's deliver-error-code bit (bit 11) is 1 if each of the following holds: (1) the interruption type is 
hardware exception; (2) bit 0 (corresponding to CRO.PE) is set in the CRO field in the guest-state area; 
(3) IA32_VMX_BASIC[56] is read as 0 (see Appendix A.1); and (4) the vector indicates one of the following 
exceptions: #DF (vector 8), #TS (10), #NP (11), #SS (12), #GP (13), #PF (14), or #AC (17). 


— The field's deliver-error-code bit is 0 if any of the following holds: (1) the interruption type is not hardware 
exception; (2) bit 0 is clear in the CRO field in the guest-state area; or (3) IA32_VMX_BASIC[56] is read as 
0 and the vector is in one of the following ranges: 0-7, 9, 15, 16, or 18-31. 


— Reserved bits in the field (30:12) are 0. 
— If the deliver-error-code bit (bit 11) is 1, bits 31:16 of the VM-entry exception error-code field are 0. 


— If the interruption type is software interrupt, software exception, or privileged software exception, the 
VM-entry instruction-length field is in the range 0-15. A VM-entry instruction length of 0 is allowed only if 
IA32_VMX_MISC[30] is read as 1; see Appendix A.6. 


The following checks are performed for the VM-entry MSR-load address if the VM-entry MSR-load count field is 
non-zero: 


— The lower 4 bits of the VM-entry MSR-load address must be 0. The address should not set any bits beyond 
the processor’s physical-address width.? 


Software can determine a processor's physical-address width by executing CPUID with BOOOOOO8H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 
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— The address of the last byte in the VM-entry MSR-load area should not set any bits beyond the processor's 
physical-address width. The address of this last byte is VM-entry MSR-load address + (MSR count * 16) - 
1. (The arithmetic used for the computation uses more bits than the processor’s physical-address width.) 


If IA32_VMX_BASIC[48] is read as 1, neither address should set any bits in the range 63:32; see Appendix 
A.1. 


¢ Ifthe processor is not in SMM, the “entry to SMM” and “deactivate dual-monitor treatment” VM-entry controls 
must be 0. 


¢ The “entry to SMM” and “deactivate dual-monitor treatment” VM-entry controls cannot both be 1. 


27.2.2 Checks on Host Control Registers, MSRs, and SSP 


The following checks are performed on fields in the host-state area that correspond to control registers and MSRs: 
* The CRO field must not set any bit to a value not supported in VMX operation (see Section 24.8).4 

° The CR4 field must not set any bit to a value not supported in VMX operation (see Section 24.8). 

¢ If bit 23 in the CR4 field (corresponding to CET) is 1, bit 16 in the CRO field (WP) must also be 1. 


* On processors that support Intel 64 architecture, the CR3 field must be such that bits 63:52 and bits in the 
range 51:32 beyond the processor’s physical-address width must be 0.2/3 

* On processors that support Intel 64 architecture, the IA32_SYSENTER_ESP field and the IA32_SYSENTER_EIP 
field must each contain a canonical address. 

° If the “load IA32_PERF_GLOBAL_CTRL” VM-exit control is 1, bits reserved in the IA32_PERF_GLOBAL_CTRL 
MSR must be 0 in the field for that register (see Figure 20-3). 


° If the “load IA32_ PAT” VM-exit control is 1, the value of the field for the IA32_PAT MSR must be one that could 
be written by WRMSR without fault at CPL 0. Specifically, each of the 8 bytes in the field must have one of the 
values 0 (UC), 1 (WC), 4 (WT), 5 (WP), 6 (WB), or 7 (UC-). 


° If the “load IA32_EFER” VM-exit control is 1, bits reserved in the IA32_EFER MSR must be 0 in the field for that 
register. In addition, the values of the LMA and LME bits in the field must each be that of the “host address- 
space size” VM-exit control. 


¢ If the “load CET state” VM-exit control is 1, the IA32_S_CET field must not set any bits reserved in the 
IA32_S_CET MSR, and bit 10 (corresponding to SUPPRESS) and bit 11 (TRACKER) in the field cannot both be 
set. 


e If the “load CET state” VM-exit control is 1, bits 1:0 must be 0 in the SSP field. 
° If the “load PKRS” VM-exit control is 1, bits 63:32 must be 0 in the IA32_PKRS field. 


27.2.3. Checks on Host Segment and Descriptor-Table Registers 
The following checks are performed on fields in the host-state area that correspond to segment and descriptor- 
table registers: 


¢ Inthe selector field for each of CS, SS, DS, ES, FS, GS, and TR, the RPL (bits 1:0) and the TI flag (bit 2) must 
be 0. 


¢ The selector fields for CS and TR cannot be OOOOH. 
¢ The selector field for SS cannot be OOOOH if the “host address-space size” VM-exit control is 0. 


* On processors that support Intel 64 architecture, the base-address fields for FS, GS, GDTR, IDTR, and TR must 
contain canonical addresses. 


1. The bits corresponding to CRO.NW (bit 29) and CRO.CD (bit 30) are never checked because the values of these bits are not changed 
by VM exit; see Section 28.5.1. 


2. Software can determine a processor's physical-address width by executing CPUID with BOOO0008H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


3. Bit 63 of the CR3 field in the host-state area must be O. This is true even though, If CR4.PCIDE = 1, bit 63 of the source operand to 
MOV to CR3 is used to determine whether cached translation information is invalidated. 
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27.2.4 Checks Related to Address-Space Size 


On processors that support Intel 64 architecture, the following checks related to address-space size are performed 
on VMX controls and fields in the host-state area: 


¢ If the logical processor is outside IA-32e mode (if IA32_EFER.LMA = 0) at the time of VM entry, the following 
must hold: 


— The “IA-32e mode guest” VM-entry control is 0. 
— The “host address-space size” VM-exit control is 0. 


¢ If the logical processor is in IA-32e mode (if IA32_EFER.LMA = 1) at the time of VM entry, the “host address- 
space size” VM-exit control must be 1. 


e If the “host address-space size” VM-exit control is 0, the following must hold: 

— The “IA-32e mode guest” VM-entry control is 0. 

— Bit 17 of the CR4 field (corresponding to CR4.PCIDE) is 0. 

— Bits 63:32 in the RIP field are 0. 

— Ifthe “load CET state” VM-exit control is 1, bits 63:32 in the IA32_S_CET field and in the SSP field are 0. 
e If the “host address-space size” VM-exit control is 1, the following must hold: 

— Bit 5 of the CR4 field (corresponding to CR4.PAE) is 1. 

— The RIP field contains a canonical address. 


— Ifthe “load CET state” VM-exit control is 1, the IA32_S_ CET field and the SSP field contain canonical 
addresses. 


e If the “load CET state” VM-exit control is 1, the IA32_INTERRUPT_SSP_TABLE_ADDR field contains a canonical 
address. 


On processors that do not support Intel 64 architecture, checks are performed to ensure that the “IA-32e mode 
guest” VM-entry control and the “host address-space size” VM-exit control are both 0. 


27.3 CHECKING AND LOADING GUEST STATE 


If all checks on the VMX controls and the host-state area pass (see Section 27.2), the following operations take 
place concurrently: (1) the guest-state area of the VMCS is checked to ensure that, after the VM entry completes, 
the state of the logical processor is consistent with IA-32 and Intel 64 architectures; (2) processor state is loaded 
from the guest-state area or as specified by the VM-entry control fields; and (3) address-range monitoring is 
cleared. 


Because the checking and the loading occur concurrently, a failure may be discovered only after some state has 
been loaded. For this reason, the logical processor responds to such failures by loading state from the host-state 
area, as it would for a VM exit. See Section 27.8. 


27.3.1 Checks on the Guest State Area 


This section describes checks performed on fields in the guest-state area. These checks may be performed in any 
order. Some checks prevent establishment of settings (or combinations of settings) that are currently reserved. 

Future processors may allow such settings (or combinations) and may not perform the corresponding checks. The 
correctness of software should not rely on VM-entry failures resulting from the checks documented in this section. 


The following subsections reference fields that correspond to processor state. Unless otherwise stated, these refer- 
ences are to fields in the guest-state area. 


27.3.1.1_ Checks on Guest Control Registers, Debug Registers, and MSRs 


The following checks are performed on fields in the guest-state area corresponding to control registers, debug 
registers, and MSRs: 
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The CRO field must not set any bit to a value not supported in VMX operation (see Section 24.8). The following 
are exceptions: 


— Bit 0 (corresponding to CRO.PE) and bit 31 (PG) are not checked if the “unrestricted guest” VM-execution 
control is 1.4 

— Bit 29 (corresponding to CRO.NW) and bit 30 (CD) are never checked because the values of these bits are 
not changed by VM entry; see Section 27.3.2.1. 

If bit 31 in the CRO field (corresponding to PG) is 1, bit 0 in that field (PE) must also be 1.2 

The CR4 field must not set any bit to a value not supported in VMX operation (see Section 24.8). 

If bit 23 in the CR4 field (corresponding to CET) is 1, bit 16 in the CRO field (WP) must also be 1. 


If the “load debug controls” VM-entry control is 1, bits reserved in the IA32_DEBUGCTL MSR must be 0 in the 
field for that register. The first processors to support the virtual-machine extensions supported only the 1- 
setting of this control and thus performed this check unconditionally. 


The following checks are performed on processors that support Intel 64 architecture: 


— Ifthe “IA-32e mode guest” VM-entry control is 1, bit 31 in the CRO field (corresponding to CRO.PG) and 
bit 5 in the CR4 field (corresponding to CR4.PAE) must each be 1.7 


— Ifthe “IA-32e mode guest” VM-entry control is 0, bit 17 in the CR4 field (corresponding to CR4.PCIDE) 
must be 0. 


— The CR3 field must be such that bits 63:52 and bits in the range 51:32 beyond the processor's physical- 
address width are 0.4"> 


— Ifthe “load debug controls” VM-entry control is 1, bits 63:32 in the DR7 field must be O. The first 
processors to support the virtual-machine extensions supported only the 1-setting of this control and thus 
performed this check unconditionally (if they supported Intel 64 architecture). 


— The IA32_SYSENTER_ESP field and the IA32_SYSENTER_EIP field must each contain a canonical address. 

— Ifthe “load CET state” VM-entry control is 1, the IA32_S_CET field and the 
IA32_INTERRUPT_SSP_TABLE_ADDR field must contain canonical addresses. 

If the “load IA32_PERF_GLOBAL_CTRL” VM-entry control is 1, bits reserved in the IA32_PERF_GLOBAL_CTRL 

MSR must be 0 in the field for that register (see Figure 20-3). 


If the “load IA32_PAT” VM-entry control is 1, the value of the field for the IA32_PAT MSR must be one that could 
be written by WRMSR without fault at CPL 0. Specifically, each of the 8 bytes in the field must have one of the 
values 0 (UC), 1 (WC), 4 (WT), 5 (WP), 6 (WB), or 7 (UC-). 

If the “load IA32_EFER” VM-entry control is 1, the following checks are performed on the field for the 
IA32_EFER MSR: 

— Bits reserved in the IA32_EFER MSR must be 0. 


— Bit 10 (corresponding to IA32_EFER.LMA) must equal the value of the “IA-32e mode guest” VM-entry 
control. It must also be identical to bit 8 (LME) if bit 31 in the CRO field (corresponding to CRO.PG) is 1.° 


. “Unrestricted guest” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution 
controls is 0, VM entry functions as if the “unrestricted guest” VM-execution control were 0. See Section 25.6.2. 

._ If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX operation, bit O in the CRO field must be 1 
unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1. 
. If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PG must be 1 in VMX operation, bit 31 in the CRO field must be 1 
unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1. 
. Software can determine a processor's physical-address width by executing CPUID with 8OOOO0O8H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 

. Bit 63 of the CR3 field in the quest-state area must be O. This is true even though, If CR4.PCIDE = 1, bit 63 of the source operand to 
MOV to CR3 is used to determine whether cached translation information is invalidated. 


. If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PG must be 1 in VMX operation, bit 31 in the CRO field must be 1 
unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1. 
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If the “load IA32_BNDCFGS” VM-entry control is 1, the following checks are performed on the field for the 
IA32_BNDCFGS MSR: 


— Bits reserved in the IA32_BNDCFGS MSR must be 0. 
— The linear address in bits 63:12 must be canonical. 


If the “load IA32_RTIT_CTL” VM-entry control is 1, bits reserved in the IA32_RTIT_CTL MSR must be 0 in the 
field for that register (see Table 33-6). 


If the “load CET state” VM-entry control is 1, the IA32_S_CET field must not set any bits reserved in the 
IA32_S_CET MSR, and bit 10 (corresponding to SUPPRESS) and bit 11 (TRACKER) of the field cannot both be 
set. 


If the “load guest IA32_LBR_CTL” VM-entry control is 1, bits reserved in the IA32_LBR_CTL MSR must be 0 in 
the field for that register. 


If the “load PKRS” VM-entry control is 1, bits 63:32 must be 0 in the IA32_PKRS field. 
If the “load UINV” VM-entry control is 1, bits 15:8 must be 0 in the guest UINV field. 


27.3.1.2 Checks on Guest Segment Registers 


This section specifies the checks on the fields for CS, SS, DS, ES, FS, GS, TR, and LDTR. The following terms are 
used in defining these checks: 


The guest will be virtual-8086 if the VM flag (bit 17) is 1 in the RFLAGS field in the guest-state area. 


The guest will be IA-32e mode if the “IA-32e mode guest” VM-entry control is 1. (This is possible only on 
processors that support Intel 64 architecture.) 


Any one of these registers is said to be usable if the unusable bit (bit 16) is 0 in the access-rights field for that 
register. 


The following are the checks on these fields: 


Selector fields. 
— TR. The TI flag (bit 2) must be 0. 
— LDTR. If LDTR is usable, the TI flag (bit 2) must be 0. 


— SS. If the guest will not be virtual-8086 and the “unrestricted guest” VM-execution control is 0, the RPL 
(bits 1:0) must equal the RPL of the selector field for CS.! 


Base-address fields. 


— CS, SS, DS, ES, FS, GS. If the guest will be virtual-8086, the address must be the selector field shifted left 
4 bits (multiplied by 16). 


— The following checks are performed on processors that support Intel 64 architecture: 
¢ TR, FS, GS. The address must be canonical. 
¢ LDTR. If LDTR is usable, the address must be canonical. 
* CS. Bits 63:32 of the address must be zero. 
¢ SS, DS, ES. If the register is usable, bits 63:32 of the address must be zero. 
Limit fields for CS, SS, DS, ES, FS, GS. If the guest will be virtual-8086, the field must be OOOOFFFFH. 
Access-rights fields. 
— CS, SS, DS, ES, FS, GS. 
¢ If the guest will be virtual-8086, the field must be OOOOOOF3H. This implies the following: 
— Bits 3:0 (Type) must be 3, indicating an expand-up read/write accessed data segment. 
— Bit 4 (S) must be 1. 


1. 


“Unrestricted quest” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution 
controls is 0, VM entry functions as if the “unrestricted quest” VM-execution control were 0. See Section 25.6.2. 
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— Bits 6:5 (DPL) must be 3. 
— Bit 7 (P) must be 1. 


— Bits 11:8 (reserved), bit 12 (software available), bit 13 (reserved/L), bit 14 (D/B), bit 15 (G), 
bit 16 (unusable), and bits 31:17 (reserved) must all be 0. 


¢ If the guest will not be virtual-8086, the different sub-fields are considered separately: 
— Bits 3:0 (Type). 


¢ CS. The values allowed depend on the setting of the “unrestricted guest” VM-execution 
control: 


— If the control is 0, the Type must be 9, 11, 13, or 15 (accessed code segment). 


— If the control is 1, the Type must be either 3 (read/write accessed expand-up data 
segment) or one of 9, 11, 13, and 15 (accessed code segment). 


¢ SS. If SS is usable, the Type must be 3 or 7 (read/write, accessed data segment). 
¢ DS, ES, FS, GS. The following checks apply if the register is usable: 
— Bit 0 of the Type must be 1 (accessed). 
— If bit 3 of the Type is 1 (code segment), then bit 1 of the Type must be 1 (readable). 
— Bit 4 (S). If the register is CS or if the register is usable, S must be 1. 
— Bits 6:5 (DPL). 
* CS. 


— If the Type is 3 (read/write accessed expand-up data segment), the DPL must be 0. The 
Type can be 3 only if the “unrestricted guest” VM-execution control is 1. 


— If the Type is 9 or 11 (non-conforming code segment), the DPL must equal the DPL in the 
access-rights field for SS. 


— If the Type is 13 or 15 (conforming code segment), the DPL cannot be greater than the 
DPL in the access-rights field for SS. 


— If the “unrestricted guest” VM-execution control is 0, the DPL must equal the RPL from the 
selector field. 


— The DPL must be 0 either if the Type in the access-rights field for CS is 3 (read/write 
aecresed expand-up data segment) or if bit 0 in the CRO field (corresponding to CRO.PE) is 
0. 


¢ DS, ES, FS, GS. The DPL cannot be less than the RPL in the selector field if (1) the 
“unrestricted guest” VM-execution control is 0; (2) the register is usable; and (3) the Type in 
the access-rights field is in the range 0 - 11 (data segment or non-conforming code segment). 


— Bit 7 (P). If the register is CS or if the register is usable, P must be 1. 
— Bits 11:8 (reserved). If the register is CS or if the register is usable, these bits must all be 0. 


— Bit 14 (D/B). For CS, D/B must be 0 if the guest will be IA-32e mode and the L bit (bit 13) in the 
access-rights field is 1. 


— Bit 15 (G). The following checks apply if the register is CS or if the register is usable: 
¢ If any bit in the limit field in the range 11:0 is 0, G must be O. 
¢ If any bit in the limit field in the range 31:20 is 1, G must be 1. 
— Bits 31:17 (reserved). If the register is CS or if the register is usable, these bits must all be 0. 


1. The following apply if either the “unrestricted guest” VM-execution control or bit 31 of the primary processor-based VM-execution 
controls is 0: (1) bit 0 in the CRO field must be 1 if the capability MSR I[A32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX 
operation; and (2) the Type in the access-rights field for CS cannot be 3. 
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— TR. The different sub-fields are considered separately: 
¢ Bits 3:0 (Type). 


— If the guest will not be IA-32e mode, the Type must be 3 (16-bit busy TSS) or 11 (32-bit busy 
TSS). 


— If the guest will be IA-32e mode, the Type must be 11 (64-bit busy TSS). 
¢ Bit 4(S). S must be 0. 
¢ Bit 7 (P). P must be 1. 
¢ Bits 11:8 (reserved). These bits must all be 0. 
* Bit 15 (G). 
— If any bit in the limit field in the range 11:0 is 0, G must be 0. 
— If any bit in the limit field in the range 31:20 is 1, G must be 1. 
¢ Bit 16 (Unusable). The unusable bit must be 0. 
¢ Bits 31:17 (reserved). These bits must all be 0. 
— LDTR. The following checks on the different sub-fields apply only if LDTR is usable: 
¢ Bits 3:0 (Type). The Type must be 2 (LDT). 
¢ Bit 4(S). S must be 0. 
¢ Bit 7 (P). P must be 1. 
¢ Bits 11:8 (reserved). These bits must all be 0. 
* Bit 15 (G). 
— If any bit in the limit field in the range 11:0 is 0, G must be 0. 
— If any bit in the limit field in the range 31:20 is 1, G must be 1. 
¢ Bits 31:17 (reserved). These bits must all be 0. 


27.3.1.3 Checks on Guest Descriptor-Table Registers 

The following checks are performed on the fields for GDTR and IDTR: 

* On processors that support Intel 64 architecture, the base-address fields must contain canonical addresses. 
° =Bits 31:16 of each limit field must be 0. 


27.3.1.4 Checks on Guest RIP, RFLAGS, and SSP 


The following checks are performed on fields in the guest-state area corresponding to RIP, RFLAGS, and SSP 
(shadow-stack pointer): 
° RIP. The following checks are performed on processors that support Intel 64 architecture: 


— Bits 63:32 must be 0 if the “IA-32e mode guest” VM-entry control is 0 or if the L bit (bit 13) in the access- 
rights field for CS is 0. 


— Ifthe processor supports N < 64 linear-address bits, bits 63:N must be identical if the “IA-32e mode guest” 
VM-entry control is 1 and the L bit in the access-rights field for CS is 1.1 (No check applies if the processor 
supports 64 linear-address bits.) The guest RIP value is not required to be canonical; the value of bit N-1 
may differ from that of bit N. 


° RFLAGS. 


— Reserved bits 63:22 (bits 31:22 on processors that do not support Intel 64 architecture), bit 15, bit 5 and 
bit 3 must be O in the field, and reserved bit 1 must be 1. 


1. Software can determine the number N by executing CPUID with 8OOO0008H in EAX. The number of linear-address bits supported is 
returned in bits 15:8 of EAX. 


27-12 Vol. 3C 


VM ENTRIES 


The VM flag (bit 17) must be 0 either if the “IA-32e mode guest” VM-entry control is 1 or if bit 0 in the CRO 
field (corresponding to CRO.PE) is 0.1 


The IF flag (RFLAGS[bit 9]) must be 1 if the valid bit (bit 31) in the VM-entry interruption-information field 
is 1 and the interruption type (bits 10:8) is external interrupt. 


SSP. The following checks are performed if the “load CET state” VM-entry control is 1 


Bits 1:0 must be O. 


If the processor supports the Intel 64 architecture, bits 63:N must be identical, where N is the CPU’s 
maximum linear-address width. (This check does not apply if the processor supports 64 linear-address 
bits.) The guest SSP value is not required to be canonical; the value of bit N-1 may differ from that of bit N. 


27.3.1.5 Checks on Guest Non-Register State 


The following checks are performed on fields in the guest-state area corresponding to non-register state: 


Activity state. 


The activity-state field must contain a value in the range O - 3, indicating an activity state supported by the 
implementation (see Section 25.4.2). Future processors may include support for other activity states. 
Software should read the VMX capability MSR IA32_VMX_MISC (see Appendix A.6) to determine what 
activity states are supported. 


The ee a field must not indicate the HLT state if the DPL (bits 6:5) in the access-rights field for SS 
is not O. 


The activity-state field must indicate the active state if the interruptibility-state field indicates blocking by 
either MOV-SS or by STI (if either bit O or bit 1 in that field is 1). 


If the valid bit (bit 31) in the VM-entry interruption-information field is 1, the interruption to be delivered 
(as defined by interruption type and vector) must not be one that would normally be blocked while a logical 
processor is in the activity state corresponding to the contents of the activity-state field. The following 
items enumerate the interruptions (as specified in the VM-entry interruption-information field) whose 
injection is allowed for the different activity states: 


¢ Active. Any interruption is allowed. 
¢ HLT. The only events allowed are the following: 
— Those with interruption type external interrupt or non-maskable interrupt (NMI). 


— Those with interruption type hardware exception and vector 1 (debug exception) or vector 18 
(machine-check exception). 


— Those with interruption type other event and vector 0 (pending MTF VM exit). 


See Table 25-17 in Section 25.8.3 for details regarding the format of the VM-entry interruption- 
information field. 


¢ Shutdown. Only NMIs and machine-check exceptions are allowed. 
¢ Wait-for-SIPI. No interruptions are allowed. 
The activity-state field must not indicate the wait-for-SIPI state if the “entry to SMM” VM-entry control is 1. 


Interruptibility state. 


The reserved bits (bits 31:5) must be 0. 
The field cannot indicate blocking by both STI and MOV SS (bits 0 and 1 cannot both be 1). 
Bit 0 (blocking by STI) must be 0 if the IF flag (bit 9) is 0 in the RFLAGS field. 


._ If the capability MSR [A32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX operation, bit 0 in the CRO field must be 1 


unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are both 1. 
As noted in Section 25.4.1, SS.DPL corresponds to the logical processor's current privilege level (CPL). 
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Bit 0 (blocking by STI) and bit 1 (blocking by MOV-SS) must both be 0 if the valid bit (bit 31) in the 
VM-entry interruption-information field is 1 and the interruption type (bits 10:8) in that field has value 0, 
indicating external interrupt, or value 2, indicating non-maskable interrupt (NMI). 


Bit 2 (blocking by SMI) must be 0 if the processor is not in SMM. 
Bit 2 (blocking by SMI) must be 1 if the “entry to SMM” VM-entry control is 1. 


Bit 3 (blocking by NMI) must be 0 if the “virtual NMIs” VM-execution control is 1, the valid bit (bit 31) in the 
VM-entry interruption-information field is 1, and the interruption type (bits 10:8) in that field has value 2 
(indicating NMI). 


If bit 4 (enclave interruption) is 1, bit 1 (blocking by MOV-SS) must be 0 and the processor must support 
for SGX by enumerating CPUID.(EAX=07H,ECX=0):EBX.SGX[bit 2] as 1. 


NOTE 


If the “virtual NMIs” VM-execution control is 0, there is no requirement that bit 3 be 0 if the valid bit 
in the VM-entry interruption-information field is 1 and the interruption type in that field has value 2. 


¢ Pending debug exceptions. 


Bits 11:4, bit 13, bit 15, and bits 63:17 (bits 31:17 on processors that do not support Intel 64 architecture) 
must be 0. 


The following checks are performed if any of the following holds: (1) the interruptibility-state field indicates 
blocking by STI (bit O in that field is 1); (2) the interruptibility-state field indicates blocking by MOV SS 
(bit 1 in that field is 1); or (3) the activity-state field indicates HLT: 


¢ Bit 14 (BS) must be 1 if the TF flag (bit 8) in the RFLAGS field is 1 and the BTF flag (bit 1) in the 
IA32_DEBUGCTL field is 0. 


¢ Bit 14 (BS) must be 0 if the TF flag (bit 8) in the RFLAGS field is 0 or the BTF flag (bit 1) in the 
IA32_DEBUGCTL field is 1. 


The following checks are performed if bit 16 (RTM) is 1: 


¢ Bits 11:0, bits 15:13, and bits 63:17 (bits 31:17 on processors that do not support Intel 64 archi- 
tecture) must be 0; bit 12 must be 1. 


¢ The processor must support for RTM by enumerating CPUID.(EAX=07H,ECX=0):EBX[bit 11] as 1. 
¢ The interruptibility-state field must not indicate blocking by MOV SS (bit 1 in that field must be 0). 


¢ VMCS link pointer. The following checks apply if the field contains a value other than FFFFFFFF_FFFFFFFFH: 


Bits 11:0 must be 0. 
Bits beyond the processor’s physical-address width must be 0.1/2 


The 4 bytes located in memory referenced by the value of the field (as a physical address) must satisfy the 
following: 

* Bits 30:0 must contain the processor’s VMCS revision identifier (see Section 25.2).? 

* Bit 31 must contain the setting of the “VMCS shadowing” VM-execution control.* This implies that the 


referenced VMCS is a shadow VMCS (see Section 25.10) if and only if the “VMCS shadowing” VM- 
execution control is 1. 


1. Software can determine a processor's physical-address width by executing CPUID with BOOOOOOSH in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


2. If 1A32_VMX_BASIC[48] is read as 1, this field must not set any bits in the range 63:32; see Appendix A.1. 

3. Earlier versions of this manual specified that the VMCS revision identifier was a 32-bit field. For all processors produced prior to this 
change, bit 31 of the VMCS revision identifier was O. 

4. “VMCS shadowing" is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution 
controls is 0, VM entry functions as if the “VMCS shadowing” VM-execution control were O. See Section 25.6.2. 
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— Ifthe processor is not in SMM or the “entry to SMM” VM-entry control is 1, the field must not contain the 
current VMCS pointer. 


— If the processor is in SMM and the “entry to SMM” VM-entry control is 0, the field must differ from the 
executive-VMCS pointer. 


27.3.1.6 Checks on Guest Page-Directory-Pointer-Table Entries 


If CRO.PG =1, CR4.PAE = 1, and IA32_EFER.LME = 0, the logical processor uses PAE paging (see Section 4.4 in 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A).! When PAE paging is in use, the 
physical address in CR3 references a table of page-directory-pointer-table entries (PDPTEs). A MOV to CR3 
when PAE paging is in use checks the validity of the PDPTEs. 


A VM entry is to a guest that uses PAE paging if (1) bit 31 (corresponding to CRO.PG) is set in the CRO field in the 
guest-state area; (2) bit 5 (corresponding to CR4.PAE) is set in the CR4 field; and (3) the “IA-32e mode guest” 
VM-entry control is 0. Such a VM entry checks the validity of the PDPTEs: 


e If the “enable EPT” VM-execution control is 0, VM entry checks the validity of the PDPTEs referenced by the CR3 
field in the guest-state area if either (1) PAE paging was not in use before the VM entry; or (2) the value of CR3 
is changing as a result of the VM entry. VM entry may check their validity even if neither (1) nor (2) hold. 


° If the “enable EPT” VM-execution control is 1, VM entry checks the validity of the PDPTE fields in the guest- 
state area (see Section 25.4.2). 


A VM entry to a guest that does not use PAE paging does not check the validity of any PDPTEs. 


A VM entry that checks the validity of the PDPTEs uses the same checks that are used when CR3 is loaded with 
MOV to CR3 when PAE paging is in use.? If MOV to CR3 would cause a general-protection exception due to the 
PDPTEs that would be loaded (e.g., because a reserved bit is set), the VM entry fails. 


27.3.2 Loading Guest State 


Processor state is updated on VM entries in the following ways: 

¢ Some state is loaded from the guest-state area. 

¢ Some state is determined by VM-entry controls. 

¢ The page-directory pointers are loaded based on the values of certain control registers. 


This loading may be performed in any order and in parallel with the checking of VMCS contents (see Section 
27.3.1). 


The loading of guest state is detailed in Section 27.3.2.1 to Section 27.3.2.4. These sections reference VMCS fields 
that correspond to processor state. Unless otherwise stated, these references are to fields in the guest-state area. 


In addition to the state loading described in this section, VM entries may load MSRs from the VM-entry MSR-load 
area (see Section 27.4). This loading occurs only after the state loading described in this section and the checking 
of VMCS contents described in Section 27.3.1. 


27.3.2.1 Loading Guest Control Registers, Debug Registers, and MSRs 


The following items describe how guest control registers, debug registers, and MSRs are loaded on VM entry: 


1. On processors that support Intel 64 architecture, the physical-address extension may support more than 36 physical-address bits. 
Software can determine the number physical-address bits supported by executing CPUID with BOOOOOOS8H in EAX. The physical- 
address width is returned in bits 7:0 of EAX. 

2. “Enable EPT” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution controls 
is 0, VM entry functions as if the “enable EPT” VM-execution control were O. See Section 25.6.2. 

3. This implies that (1) bits 11:9 in each PDPTE are ignored; and (2) if bit O (present) is clear in one of the PDPTEs, bits 63:1 of that 
PDPTE are ignored. 
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* CRO is loaded from the CRO field with the exception of the following bits, which are never modified on VM entry: 
ET (bit 4); reserved bits 15:6, 17, and 28:19; NW (bit 29) and CD (bit 30).! The values of these bits in the CRO 
field are ignored. 


* CR3 and CR4 are loaded from the CR3 field and the CR4 field, respectively. 


¢ If the “load debug controls” VM-entry control is 1, DR7 is loaded from the DR7 field with the exception that 
bit 12 and bits 15:14 are always 0 and bit 10 is always 1. The values of these bits in the DR7 field are ignored. 


The first processors to support the virtual-machine extensions supported only the i-setting of the “load 
debug controls” VM-entry control and thus always loaded DR7 from the DR7 field. 


° The following describes how certain MSRs are loaded using fields in the guest-state area: 


— Ifthe “load debug controls” VM-entry control is 1, the IA32_DEBUGCTL MSR is loaded from the 
IA32_DEBUGCTL field. The first processors to support the virtual-machine extensions supported only the 1- 
setting of this control and thus always loaded the IA32_DEBUGCTL MSR from the IA32_DEBUGCTL field. 


— The IA32_SYSENTER_CS MSR is loaded from the IA32_SYSENTER_CS field. Since this field has only 32 bits, 
bits 63:32 of the MSR are cleared to 0. 


— The IA32_SYSENTER_ESP and IA32_SYSENTER_EIP MSRs are loaded from the IA32_SYSENTER_ESP field 
and the IA32_SYSENTER_EIP field, respectively. On processors that do not support Intel 64 architecture, 
these fields have only 32 bits; bits 63:32 of the MSRs are cleared to 0. 


— The following are performed on processors that support Intel 64 architecture: 


¢ The MSRs FS.base and GS.base are loaded from the base-address fields for FS and GS, respectively 
(see Section 27.3.2.2). 


¢ If the “load IA32_EFER” VM-entry control is 0, bits in the IA32_EFER MSR are modified as follows: 
— IA32_EFER.LMA is loaded with the setting of the “IA-32e mode guest” VM-entry control. 


— If CRO is being loaded so that CRO.PG = 1, IA32_EFER.LME is also loaded with the setting of the 
“IA-32e mode guest” VM-entry control. Otherwise, IA32_EFER.LME is unmodified. 


See below for the case in which the “load IA32_EFER” VM-entry control is 1 


— Ifthe “load IA32_PERF_GLOBAL_CTRL” VM-entry control is 1, the IA32_PERF_GLOBAL_CTRL MSR is loaded 
from the IA32_PERF_GLOBAL_CTRL field. 


— If the “load IA32_PAT” VM-entry control is 1, the IA32_PAT MSR is loaded from the IA32_PAT field. 
— Ifthe “load IA32_EFER” VM-entry control is 1, the IA32_EFER MSR is loaded from the IA32_EFER field. 


— Ifthe “load IA32_BNDCFGS” VM-entry control is 1, the IA32_BNDCFGS MSR is loaded from the 
IA32_BNDCFGS field. 


— Ifthe “load IA32_RTIT_CTL” VM-entry control is 1, the IA32_RTIT_CTL MSR is loaded from the 
IA32_RTIT_CTL field. 


— Ifthe “load CET” VM-entry control is 1, the IA32_S_CET and IJA32_INTERRUPT_SSP_TABLE_ADDR MSRs 
are loaded from the IA32_S_CET field and the IA32_INTERRUPT_SSP_TABLE_ADDR field, respectively. On 
processors that do not support Intel 64 architecture, these fields have only 32 bits; bits 63:32 of the MSRs 
are cleared to 0. 


— Ifthe “load guest IA32_LBR_CTL” VM-entry control is 1, the IA32_LBR_CTL MSR is loaded from the 
IA32_LBR_CTL guest state field. 


— Ifthe “load PKRS” VM-entry control is 1, the IA32_PKRS MSR is loaded from the IA32_PKRS field. 


— Ifthe “load UINV” VM-entry control is 1, UINV is loaded with the low 8 bits of the UINV field. UINV is 
represented in bits 39:32 of the IA32_UINTR_MISC MSR. The remainder of the MSR is not modified. 


1. Bits 15:6, bit 17, and bit 28:19 of CRO and CRO.ET are unchanged by executions of MOV to CRO. Bits 15:6, bit 17, and bit 28:19 of 
CRO are always O and CRO.ET is always 1. 

2. If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PG must be 1 in VMX operation, VM entry must be loading CRO so 
that CRO.PG = 1 unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution con- 
trols are both 1. 
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With the exception of FS.base and GS.base, any of these MSRs is subsequently overwritten if it appears in the 
VM-entry MSR-load area. See Section 27.4. 


The SMBASE register is unmodified by all VM entries except those that return from SMM. 


27.3.2.2 Loading Guest Segment Registers and Descriptor-Table Registers 
For each of CS, SS, DS, ES, FS, GS, TR, and LDTR, fields are loaded from the guest-state area as follows: 


The unusable bit is loaded from the access-rights field. This bit can never be set for TR (see Section 27.3.1.2). 
If it is set for one of the other registers, the following apply: 


— For each of CS, SS, DS, ES, FS, and GS, uses of the segment cause faults (general-protection exception or 
stack-fault exception) outside 64-bit mode, just as they would had the segment been loaded using a null 
selector. This bit does not cause accesses to fault in 64-bit mode. 


— If this bit is set for LDTR, uses of LDTR cause general-protection exceptions in all modes, just as they would 
had LDTR been loaded using a null selector. 


If this bit is clear for any of CS, SS, DS, ES, FS, GS, TR, and LDTR, a null selector value does not cause a fault 
(general-protection exception or stack-fault exception). 


TR. The selector, base, limit, and access-rights fields are loaded. 
cs. 


— The following fields are always loaded: selector, base address, limit, and (from the access-rights field) the 
L, D, and G bits. 


— For the other fields, the unusable bit of the access-rights field is consulted: 
¢ If the unusable bit is 0, all of the access-rights field is loaded. 
¢ Ifthe unusable bit is 1, the remainder of CS access rights are undefined after VM entry. 
SS, DS, ES, FS, GS, and LDTR. 
— The selector fields are loaded. 
— For the other fields, the unusable bit of the corresponding access-rights field is consulted: 


¢ If the unusable bit is 0, the base-address, limit, and access-rights fields are loaded. 


¢ If the unusable bit is 1, the base address, the segment limit, and the remainder of the access rights are 
undefined after VM entry with the following exceptions: 


— Bits 3:0 of the base address for SS are cleared to 0. 


— SS.DPL is always loaded from the SS access-rights field. This will be the current privilege level 
(CPL) after the VM entry completes. 


— SS.B is always set to 1. 


— The base addresses for FS and GS are loaded from the corresponding fields in the VMCS. On 
processors that support Intel 64 architecture, the values loaded for base addresses for FS and GS 
are also manifest in the FS.base and GS.base MSRs. 


— On processors that support Intel 64 architecture, the base address for LDTR is set to an undefined 
but canonical value. 


— On processors that support Intel 64 architecture, bits 63:32 of the base addresses for SS, DS, and 
ES are cleared to 0. 


GDTR and IDTR are loaded using the base and limit fields. 


27.3.2.3 Loading Guest RIP, RSP, RFLAGS, and SSP 

RSP, RIP, and RFLAGS are loaded from the RSP field, the RIP field, and the RFLAGS field, respectively. 
If the “load CET” VM-entry control is 1, SSP (shadow-stack pointer) is loaded from the SSP field. 

The following items regard the upper 32 bits of these fields on VM entries that are not to 64-bit mode: 
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° Bits 63:32 of RSP are undefined outside 64-bit mode. Thus, a logical processor may ignore the contents of 
bits 63:32 of the RSP field on VM entries that are not to 64-bit mode. 


¢ As noted in Section 27.3.1.4, bits 63:32 of the RIP and RFLAGS fields must be 0 on VM entries that are not to 


64-bit mode. (The same is true for SSP for VM entries that are not to 64-bit mode when the “load CET” VM- 
entry control is 1.) 


27.3.2.4 Loading Page-Directory-Pointer-Table Entries 


As noted in Section 27.3.1.6, the logical processor uses PAE paging if CRO.PG = 1, CR4.PAE = 1, and 
IA32_EFER.LME = 0. AVM entry to a guest that uses PAE paging loads the PDPTEs into internal, non-architectural 
registers based on the setting of the “enable EPT” VM-execution control: 


¢ If the control is 0, the PDPTEs are loaded from the page-directory-pointer table referenced by the physical 
address in the value of CR3 being loaded by the VM entry (see Section 27.3.2.1). The values loaded are treated 
as physical addresses in VMX non-root operation. 


¢ If the control is 1, the PDPTEs are loaded from corresponding fields in the guest-state area (see Section 
25.4.2). The values loaded are treated as guest-physical addresses in VMX non-root operation. 


27.3.2.5 Updating Non-Register State 


Section 29.4 describes how the VMX architecture controls how a logical processor manages information in the TLBs 
and paging-structure caches. The following items detail how VM entries invalidate cached mappings: 


e If the “enable VPID” VM-execution control is 0, the logical processor invalidates linear mappings and combined 
mappings associated with VPID OOOOH (for all PCIDs); combined mappings for VPID OOOOH are invalidated for 
all EPTRTA values (EPTRTA is the value of bits 51:12 of EPTP). 


e VM entries are not required to invalidate any guest-physical mappings, nor are they required to invalidate any 
linear mappings or combined mappings if the “enable VPID” VM-execution control is 1. 


If the “virtual-interrupt delivery” VM-execution control is 1, VM entry loads the values of RVI and SVI from the 
guest interrupt-status field in the VMCS (see Section 25.4.2). After doing so, the logical processor first causes PPR 
virtualization (Section 30.1.3) and then evaluates pending virtual interrupts (Section 30.2.1). 

If a virtual interrupt is recognized, it may be delivered in VMX non-root operation immediately after VM entry 
(including any specified event injection) completes; see Section 27.7.5. See Section 30.2.2 for details regarding 
the delivery of virtual interrupts. 


27.3.3 Clearing Address-Range Monitoring 


The Intel 64 and IA-32 architectures allow software to monitor a specified address range using the MONITOR and 
MWAIT instructions. See Section 9.10.4 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A. VM entries clear any address-range monitoring that may be in effect. 


27.4 LOADING MSRS 


VM entries may load MSRs from the VM-entry MSR-load area (see Section 25.8.2). Specifically each entry in that 

area (up to the number specified in the VM-entry MSR-load count) is processed in order by loading the MSR indexed 
by bits 31:0 with the contents of bits 127:64 as they would be written by WRMSR.? 

Processing of an entry fails in any of the following cases: 

° The value of bits 31:0 is either COO00100H (the IA32_FS_BASE MSR) or C0000101 (the IA32_GS_BASE MSR). 


¢ The value of bits 31:8 is OO0008H, meaning that the indexed MSR is one that allows access to an APIC register 
when the local APIC is in x2APIC mode. 


1. Because attempts to modify the value of IA32_EFER.LMA by WRMSR are ignored, attempts to modify it using the VM-entry MSR- 
load area are also ignored. 
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¢ The value of bits 31:0 indicates an MSR that can be written only in system-management mode (SMM) and the 
VM entry did not commence in SMM. (IA32_SMM_MONITOR_CTL is an MSR that can be written only in SMM.) 


¢ The value of bits 31:0 indicates an MSR that cannot be loaded on VM entries for model-specific reasons. A 
processor may prevent loading of certain MSRs even if they can normally be written by WRMSR. Such model- 
specific behavior is documented in Chapter 2, “Model-Specific Registers (MSRs),” in the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 4. 


¢  =6Bits 63:32 are not all 0. 


¢ An attempt to write bits 127:64 to the MSR indexed by bits 31:0 of the entry would cause a general-protection 
exception if executed via WRMSR with CPL = 0.! 


The VM entry fails if processing fails for any entry. The logical processor responds to such failures by loading state 
from the host-state area, as it would for a VM exit. See Section 27.8. 


If any MSR is being loaded in such a way that would architecturally require a TLB flush, the TLBs are updated so 
that, after VM entry, the logical processor will not use any translations that were cached before the transition. 


27.5 TRACE-ADDRESS PRE-TRANSLATION (TAPT) 


When the “Intel PT uses guest physical addresses” VM-execution control is 1, the addresses used by Intel PT are 
treated as guest-physical addresses, and these are translated to physical addresses using EPT. 


VM entry uses trace-address pre-translation (TAPT) to prevent buffered trace data from being lost due to an 
EPT violation; see Section 26.5.4.2. VM entry uses TAPT only if Intel PT will be enabled following VM entry 
(IA32_RTIT_CTL.TraceEn = 1) and only if the “Intel PT uses guest physical addresses” VM-execution control is 1 


As noted in Section 26.5.4, TAPT may cause a VM exit due to an EPT violation, EPT misconfiguration, page-modifi- 
cation log-full event, or APIC access. If such a VM exit occurs as a result of TAPT during VM entry, the VM exit oper- 
ates as if it had occurred in VMX non-root operation after the VM entry completed (in the guest context). 


If TAPT during VM entry causes a VM exit, the VM entry does not perform event injection (Section 27.6), even if the 
valid bit in the VM-entry interruption-information field is 1. Such VM exits save the contents of VM-entry interrup- 
tion-information and VM-entry exception error code fields into the IDT-vectoring information and IDT-vectoring 
error code fields, respectively. 


27.6 EVENT INJECTION 


If the valid bit in the VM-entry interruption-information field (see Section 25.8.3) is 1, VM entry causes an event to 
be delivered (or made pending) after all components of guest state have been loaded (including MSRs) and after 
the VM-execution control fields have been established. 


¢ If the interruption type in the field is 0 (external interrupt), 2 (non-maskable interrupt); 3 (hardware 
exception), 4 (software interrupt), 5 (privileged software exception), or 6 (software exception), the event is 
delivered as described in Section 27.6.1. 


¢ If the interruption type in the field is 7 (other event) and the vector field is 0, an MTF VM exit is pending after 
VM entry. See Section 27.6.2. 


27.6.1 Vectored-Event Injection 


VM entry delivers an injected vectored event within the guest context established by VM entry. This means that 
delivery occurs after all components of guest state have been loaded (including MSRs) and after the VM-execution 
control fields have been established. The event is delivered using the vector in that field to select a descriptor in 
the IDT. Since event injection occurs after loading IDTR from the guest-state area, this is the guest IDT. 


1. If CRO.PG = 1, WRMSR to the IA32_EFER MSR causes a general-protection exception if it would modify the LME bit. If VM entry has 
established CRO.PG = 1, the IA32_EFER MSR should not be included in the VM-entry MSR-load area for the purpose of modifying the 
LME bit. 
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Section 27.6.1.1 provides details of vectored-event injection. In general, the event is delivered exactly as if it had 
been generated normally. 


An exception is made if the following all hold: bit 25 (UINTR) is set to 1 in the guest CR4 field and the “IA-32e mode 
guest” VM-entry control is 1, and VM entry is modified if it is injecting an external interrupt whose vector is the 
value that UINV would have after VM entry. In this case, the logical processor then performs user-interrupt notifi- 
cation processing as specified in Section 7.5.2 instead of the process described in Section 27.6.1.1. (If the guest 
activity-state field indicated the HLT state, the logical processor enters the HLT state following user-interrupt noti- 
fication processing.) 


If event delivery (or user-interrupt notification processing; see above) encounters a nested exception (for 
example, a general-protection exception because the vector indicates a descriptor beyond the IDT limit), the 
exception bitmap is consulted using the vector of that exception: 


e If the bit for the nested exception is 0, the nested exception is delivered normally. If the nested exception is 
benign, it is delivered through the IDT. If it is contributory or a page fault, a double fault may be generated, 
depending on the nature of the event whose delivery encountered the nested exception. See Chapter 6, 
“Interrupt 8—Double Fault Exception (#DF)” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3A. 


e If the bit for the nested exception is 1, a VM exit occurs. Section 27.6.1.2 details cases in which event injection 
causes a VM exit. 


27.6.1.1 Details of Vectored-Event Injection 


The event-injection process is controlled by the contents of the VM-entry interruption information field (format 
given in Table 25-17), the VM-entry exception error-code field, and the VM-entry instruction-length field. The 
following items provide details of the process: 


¢ The value pushed on the stack for RFLAGS is generally that which was loaded from the guest-state area. The 
value pushed for the RF flag is not modified based on the type of event being delivered. However, the pushed 
value of RFLAGS may be modified if a software interrupt is being injected into a guest that will be in virtual- 
8086 mode (see below). After RFLAGS is pushed on the stack, the value in the RFLAGS register is modified as 
is done normally when delivering an event through the IDT. 


¢ The instruction pointer that is pushed on the stack depends on the type of event and whether nested exceptions 
occur during its delivery. The term current guest RIP refers to the value to be loaded from the guest-state 
area. The value pushed is determined as follows: 


— If VM entry successfully injects (with no nested exception) an event with interruption type external 
interrupt, NMI, or hardware exception, the current guest RIP is pushed on the stack. 


— If VM entry successfully injects (with no nested exception) an event with interruption type software 
interrupt, privileged software exception, or software exception, the current guest RIP is incremented by the 
VM-entry instruction length before being pushed on the stack. 


— If VM entry encounters an exception while injecting an event and that exception does not cause a VM exit, 
the current guest RIP is pushed on the stack regardless of event type or VM-entry instruction length. If the 
encountered exception does cause a VM exit that saves RIP, the saved RIP is current guest RIP. 


° If the deliver-error-code bit (bit 11) is set in the VM-entry interruption-information field, the contents of the 
VM-entry exception error-code field is pushed on the stack as an error code would be pushed during delivery of 
an exception. 


° DR6, DR7, and the IA32_DEBUGCTL MSR are not modified by event injection, even if the event has vector 1 
(normal deliveries of debug exceptions, which have vector 1, do update these registers). 


2. This does not imply that injection of an exception or interrupt will cause a VM exit due to the settings of VM-execution control fields 
(such as the exception bitmap) that would cause a VM exit if the event had occurred in VMX non-root operation. In contrast, a nested 
exception encountered during event delivery may cause a VM exit; see Section 27.6.1.1. 

1. Hardware exceptions with the following unused vectors are considered benign: 15 and 21-31. A hardware exception with vector 20 
is considered benign unless the processor supports the 1-setting of the “EPT-violation #VE” VM-execution control; in that case, it 
has the same severity as page faults. 


2. While these items refer to RIP, the width of the value pushed (16 bits, 32 bits, or 64 bits) is determined normally. 
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If VM entry is injecting a software interrupt and the guest will be in virtual-8086 mode (RFLAGS.VM = 1), no 
general-protection exception can occur due to RFLAGS.IOPL < 3. AVM monitor should check RFLAGS.IOPL 
before injecting such an event and, if desired, inject a general-protection exception instead of a software 
interrupt. 


If VM entry is injecting a software interrupt and the guest will be in virtual-8086 mode with virtual-8086 mode 
extensions (RFLAGS.VM = CR4.VME = 1), event delivery is subject to VME-based interrupt redirection based 
on the software interrupt redirection bitmap in the task-state segment (TSS) as follows: 


— If bit nin the bitmap is clear (where rn is the number of the software interrupt), the interrupt is directed to 
an 8086 program interrupt handler: the processor uses a 16-bit interrupt-vector table (IVT) located at 
linear address zero. If the value of RFLAGS.IOPL is less than 3, the following modifications are made to the 
value of RFLAGS that is pushed on the stack: IOPL is set to 3, and IF is set to the value of VIF. 


— If bit nin the bitmap is set (where n is the number of the software interrupt), the interrupt is directed to a 
protected-mode interrupt handler. (In other words, the injection is treated as described in the next item.) 
In this case, the software interrupt does not invoke such a handler if RFLAGS.IOPL < 3 (a general- 
protection exception occurs instead). However, as noted above, RFLAGS.IOPL cannot cause an injected 
software interrupt to cause such a exception. Thus, in this case, the injection invokes a protected-mode 
interrupt handler independent of the value of RFLAGS.IOPL. 


Injection of events of other types are not subject to this redirection. 


If VM entry is injecting a software interrupt (not redirected as described above) or software exception, privilege 
checking is performed on the IDT descriptor being accessed as would be the case for executions of INT n, INT3, 
or INTO (the descriptor’s DPL cannot be less than CPL). There is no checking of RFLAGS.IOPL, even if the guest 
will be in virtual-8086 mode. Failure of this check may lead to a nested exception. Injection of an event with 
interruption type external interrupt, NMI, hardware exception, and privileged software exception, or with inter- 
ruption type software interrupt and being redirected as described above, do not perform these checks. 


If VM entry is injecting a non-maskable interrupt (NMI) and the “virtual NMIs” VM-execution control is 1, 
virtual-NMI blocking is in effect after VM entry. 

The transition causes a last-branch record to be logged if the LBR bit is set in the IA32_ DEBUGCTL MSR. This is 
true even for events such as debug exceptions, which normally clear the LBR bit before delivery. 

The last-exception record MSRs (LERs) may be updated based on the setting of the LBR bit in the 
IA32_DEBUGCTL MSR. Events such as debug exceptions, which normally clear the LBR bit before they are 
delivered, and therefore do not normally update the LERs, may do so as part of VM-entry event injection. 


If injection of an event encounters a nested exception, the value of the EXT bit (bit 0) in any error code for that 
nested exception is determined as follows: 


— If event being injected has interruption type external interrupt, NMI, hardware exception, or privileged 
software exception and encounters a nested exception (but does not produce a double fault), the error code 
for that exception sets the EXT bit. 


— If event being injected is a software interrupt or a software exception and encounters a nested exception, 
the error code for that exception clears the EXT bit. 


— If event delivery encounters a nested exception and delivery of that exception encounters another 
exception (but does not produce a double fault), the error code for that exception sets the EXT bit. 


— Ifa double fault is produced, the error code for the double fault is OOOOH (the EXT bit is clear). 


27.6.1.2 VM Exits During Event Injection 


An event being injected never causes a VM exit directly regardless of the settings of the VM-execution controls. For 
example, setting the “NMI exiting” VM-execution control to 1 does not cause a VM exit due to injection of an NMI. 


However, the event-delivery process may lead to a VM exit: 


If the vector in the VM-entry interruption-information field identifies a task gate in the IDT, the attempted task 
switch may cause a VM exit just as it would had the injected event occurred during normal execution in VMX 
non-root operation (see Section 26.4.2). 


If event delivery encounters a nested exception, a VM exit may occur depending on the contents of the 
exception bitmap (see Section 26.2). 
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e If event delivery generates a double-fault exception (due to a nested exception); the logical processor 
encounters another nested exception while attempting to call the double-fault handler; and that exception does 
not cause a VM exit due to the exception bitmap; then a VM exit occurs due to triple fault (see Section 26.2). 


¢ If event delivery injects a double-fault exception and encounters a nested exception that does not cause a 
VM exit due to the exception bitmap, then a VM exit occurs due to triple fault (see Section 26.2). 


e If the “virtualize APIC accesses” VM-execution control is 1 and event delivery generates an access to the APIC- 
access page, that access is treated as described in Section 30.4 and may cause a VM exit.! 


If the event-delivery process does cause a VM exit, the processor state before the VM exit is determined just as it 
would be had the injected event occurred during normal execution in VMX non-root operation. If the injected event 
directly accesses a task gate that cause a VM exit or if the first nested exception encountered causes a VM exit, 
information about the injected event is saved in the IDT-vectoring information field (see Section 28.2.4). 


The material in this section applies also if injection of an external interrupt results in user-interrupt notification 
processing instead of event delivery (see Section 27.6.1 earlier). 


27.6.1.3 Event Injection for VM Entries to Real-Address Mode 


If VM entry is loading CRO.PE with 0, any injected vectored event is delivered as would normally be done in real- 
address mode.? Specifically, VM entry uses the vector provided in the VM-entry interruption-information field to 
select a 4-byte entry from an interrupt-vector table at the linear address in IDTR.base. Further details are provided 
in Section 15.1.4 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A. 


Because bit 11 (deliver error code) in the VM-entry interruption-information field must be 0 if CRO.PE will be 0 after 
VM entry (see Section 27.2.1.3), vectored events injected with CRO.PE = 0 do not push an error code on the stack. 
This is consistent with event delivery in real-address mode. 


If event delivery encounters a fault (due to a violation of IDTR.limit or of SS.limit), the fault is treated as if it had 
occurred during event delivery in VMX non-root operation. Such a fault may lead to a VM exit as discussed in 
Section 27.6.1.2. 


27.6.2 Injection of Pending MTF VM Exits 


If the interruption type in the VM-entry interruption-information field is 7 (other event) and the vector field is 0, 
VM entry causes an MTF VM exit to be pending on the instruction boundary following VM entry. This is the case 
even if the “monitor trap flag” VM-execution control is 0. See Section 26.5.2 for the treatment of pending MTF 
VM exits. 


27.7 SPECIAL FEATURES OF VM ENTRY 


This section details a variety of features of VM entry. It uses the following terminology: a VM entry is vectoring if 
the valid bit (bit 31) of the VM-entry interruption information field is 1 and the interruption type in the field is 0 
(external interrupt), 2 (non-maskable interrupt); 3 (hardware exception), 4 (software interrupt), 5 (privileged 
software exception), or 6 (software exception). 


27.7.1 —‘Interruptibility State 


The interruptibility-state field in the guest-state area (see Table 25-3) contains bits that control blocking by STI, 
blocking by MOV SS, and blocking by NMI. This field impacts event blocking after VM entry as follows: 


1. “Virtualize APIC accesses” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execu- 
tion controls is 0, VM entry functions as if the “virtualize APIC accesses” VM-execution control were O. See Section 25.6.2. 

2. If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX operation, VM entry must be loading CRO.PE 
with 1 unless the “unrestricted guest” VM-execution control and bit 31 of the primary processor-based VM-execution controls are 
both 1. 
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If the VM entry is vectoring, there is no blocking by STI or by MOV SS following the VM entry, regardless of the 
contents of the interruptibility-state field. 


If the VM entry is not vectoring, the following apply: 


— Events are blocked by STI if and only if bit 0 in the interruptibility-state field is 1. This blocking is cleared 
after the guest executes one instruction or incurs an exception (including a debug exception made pending 
by VM entry; see Section 27.7.3). 


— Events are blocked by MOV SS if and only if bit 1 in the interruptibility-state field is 1. This may affect the 
treatment of pending debug exceptions; see Section 27.7.3. This blocking is cleared after the guest 
executes one instruction or incurs an exception (including a debug exception made pending by VM entry). 


The blocking of non-maskable interrupts (NMIs) is determined as follows: 


— Ifthe “virtual NMIs” VM-execution control is 0, NMIs are blocked if and only if bit 3 (blocking by NMI) in the 
interruptibility-state field is 1. If the “NMI exiting” VM-execution control is 0, execution of the IRET 
instruction removes this blocking (even if the instruction generates a fault). If the “NMI exiting” control is 
1, IRET does not affect this blocking. 


— The following items describe the use of bit 3 (blocking by NMI) in the interruptibility-state field if the 
“virtual NMIs” VM-execution control is 1: 


¢ The bit’s value does not affect the blocking of NMIs after VM entry. NMIs are not blocked in VMX non- 
root operation (except for ordinary blocking for other reasons, such as by the MOV SS instruction, the 
wait-for-SIPI state, etc.) 


¢ The bit’s value determines whether there is virtual-NMI blocking after VM entry. If the bit is 1, virtual- 
NMI blocking is in effect after VM entry. If the bit is 0, there is no virtual-NMI blocking after VM entry 
unless the VM entry is injecting an NMI (see Section 27.6.1.1). Execution of IRET removes virtual-NMI 
blocking (even if the instruction generates a fault). 


If the “NMI exiting” VM-execution control is 0, the “virtual NMIs” control must be 0; see Section 27.2.1.1. 
Blocking of system-management interrupts (SMIs) is determined as follows: 


— Ifthe VM entry was not executed in system-management mode (SMM), SMI blocking is unchanged by 
VM entry. 


— Ifthe VM entry was executed in SMM, SMIs are blocked after VM entry if and only if the bit 2 in the inter- 
ruptibility-state field is 1. 


27.7.2 Activity State 


The activity-state field in the guest-state area controls whether, after VM entry, the logical processor is active or in 
one of the inactive states identified in Section 25.4.2. The use of this field is determined as follows: 


If the VM entry is vectoring, the logical processor is in the active state after VM entry. While the consistency 
checks described in Section 27.3.1.5 on the activity-state field do apply in this case, the contents of the 
activity-state field do not determine the activity state after VM entry. 


If the VM entry is not vectoring, the logical processor ends VM entry in the activity state specified in the guest- 
state area. If VM entry ends with the logical processor in an inactive activity state, the VM entry generates any 
special bus cycle that is normally generated when that activity state is entered from the active state. If 

VM entry would end with the logical processor in the shutdown state and the logical processor is in SMX 
operation,! an Intel® TXT shutdown condition occurs. The error code used is 0000H, indicating “legacy 
shutdown.” See the Intel® Trusted Execution Technology Preliminary Architecture Specification. 


Some activity states unconditionally block certain events. The following blocking is in effect after any VM entry 
that puts the processor in the indicated state: 


— The active state blocks start-up IPIs (SIPIs). SIPIs that arrive while a logical processor is in the active state 
and in VMX non-root operation are discarded and do not cause VM exits. 


. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. See 


Chapter 6, “Safer Mode Extensions Reference,” in the Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 2B. 
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— The HLT state blocks start-up IPIs (SIPIs). SIPIs that arrive while a logical processor is in the HLT state and 
in VMX non-root operation are discarded and do not cause VM exits. 


— The shutdown state blocks external interrupts and SIPIs. External interrupts that arrive while a logical 
processor is in the shutdown state and in VMX non-root operation do not cause VM exits even if the 
“external-interrupt exiting” VM-execution control is 1. SIPIs that arrive while a logical processor is in the 
shutdown state and in VMX non-root operation are discarded and do not cause VM exits. 


— The wait-for-SIPI state blocks external interrupts, non-maskable interrupts (NMIs), INIT signals, and 
system-management interrupts (SMIs). Such events do not cause VM exits if they arrive while a logical 
processor is in the wait-for-SIPI state and in VMX non-root operation. 


27.7.3. Delivery of Pending Debug Exceptions after VM Entry 


The pending debug exceptions field in the guest-state area indicates whether there are debug exceptions that have 
not yet been delivered (see Section 25.4.2). This section describes how these are treated on VM entry. 


There are no pending debug exceptions after VM entry if any of the following are true: 


¢ The VM entry is vectoring with one of the following interruption types: external interrupt, non-maskable 
interrupt (NMI), hardware exception, or privileged software exception. 


¢ The interruptibility-state field does not indicate blocking by MOV SS and the VM entry is vectoring with either of 
the following interruption type: software interrupt or software exception. 


¢ The VM entry is not vectoring and the activity-state field indicates either shutdown or wait-for-SIPI. 


If none of the above hold, the pending debug exceptions field specifies the debug exceptions that are pending for 
the guest. There are valid pending debug exceptions if either the BS bit (bit 14) or the enable-breakpoint bit 
(bit 12) is 1. If there are valid pending debug exceptions, they are handled as follows: 


e If the VM entry is not vectoring, the pending debug exceptions are treated as they would had they been 
encountered normally in guest execution: 


— If the logical processor is not blocking such exceptions (the interruptibility-state field indicates no blocking 
by MOV SS), a debug exception is delivered after VM entry (see below). 


— Ifthe logical processor is blocking such exceptions (due to blocking by MOV SS), the pending debug 
exceptions are held pending or lost as would normally be the case. 


¢ If the VM entry is vectoring (with interruption type software interrupt or software exception and with blocking 
by MOV SS), the following items apply: 


— For injection of a software interrupt or of a software exception with vector 3 (#BP) or vector 4 (#OF) — or 
a privileged software exception with vector 1 (#DB) — the pending debug exceptions are treated as they 
would had they been encountered normally in guest execution if the corresponding instruction (INT1, INT3, 
or INTO) were executed after a MOV SS that encountered a debug trap. 


— For injection of a software exception with a vector other than 3 and 4, the pending debug exceptions may 
be lost or they may be delivered after injection (see below). 


If there are no valid pending debug exceptions (as defined above), no pending debug exceptions are delivered after 
VM entry. 


If a pending debug exception is delivered after VM entry, it has the priority of “traps on the previous instruction” 
(see Section 6.9 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A). Thus, INIT 
signals and system-management interrupts (SMIs) take priority of such an exception, as do VM exits induced by 
the TPR threshold (see Section 27.7.7) and pending MTF VM exits (see Section 27.7.8. The exception takes priority 
over any pending non-maskable interrupt (NMI) or external interrupt and also over VM exits due to the 1-settings 
of the “interrupt-window exiting” and “NMI-window exiting” VM-execution controls. 


A pending debug exception delivered after VM entry causes a VM exit if the bit 1 (#DB) is 1 in the exception 
bitmap. If it does not cause a VM exit, it updates DR6 normally. 
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27.7.4 WVWMX-Preemption Timer 
If the “activate VMX-preemption timer” VM-execution control is 1, VM entry starts the VMX-preemption timer with 
the unsigned value in the VMX-preemption timer-value field. 


It is possible for the VMX-preemption timer to expire during VM entry (e.g., if the value in the VMX-preemption 
timer-value field is zero). If this happens (and if the VM entry was not to the wait-for-SIPI state), a VM exit occurs 
with its normal priority after any event injection and before execution of any instruction following VM entry. For 
example, any pending debug exceptions established by VM entry (see Section 27.7.3) take priority over a timer- 
induced VM exit. (The timer-induced VM exit will occur after delivery of the debug exception, unless that exception 
or its delivery causes a different VM exit.) 


See Section 26.5.1 for details of the operation of the VMX-preemption timer in VMX non-root operation, including 
the blocking and priority of the VM exits that it causes. 


27.7.5  Interrupt-Window Exiting and Virtual-Interrupt Delivery 


If “interrupt-window exiting” VM-execution control is 1, an open interrupt window may cause a VM exit immedi- 
ately after VM entry (see Section 26.2 for details). If the “interrupt-window exiting” VM-execution control is 0 but 
the “virtual-interrupt delivery” VM-execution control is 1, a virtual interrupt may be delivered immediately after 
VM entry (see Section 27.3.2.5 and Section 30.2.1). 


The following items detail the treatment of these events: 
° These events occur after any event injection specified for VM entry. 


¢ Non-maskable interrupts (NMIs) and higher priority events take priority over these events. These events take 
priority over external interrupts and lower priority events. 


¢ These events wake the logical processor if it just entered the HLT state because of a VM entry (see Section 
27.7.2). They do not occur if the logical processor just entered the shutdown state or the wait-for-SIPI state. 


27.7.6 NMI-Window Exiting 


The “NMI-window exiting” VM-execution control may cause a VM exit to occur immediately after VM entry (see 
Section 26.2 for details). 


The following items detail the treatment of these VM exits: 
¢ These VM exits follow event injection if such injection is specified for VM entry. 


° Debug-trap exceptions (see Section 27.7.3) and higher priority events take priority over VM exits caused by 
this control. VM exits caused by this control take priority over non-maskable interrupts (NMIs) and lower 
priority events. 


¢ VM exits caused by this control wake the logical processor if it just entered either the HLT state or the shutdown 
state because of a VM entry (see Section 27.7.2). They do not occur if the logical processor just entered the 
wait-for-SIPI state. 


27.7.7 \JM Exits Induced by the TPR Threshold 


If the “use TPR shadow” and “virtualize APIC accesses” VM-execution controls are both 1 and the “virtual-interrupt 
delivery” VM-execution control is 0, a VM exit occurs immediately after VM entry if the value of bits 3:0 of the TPR 
threshold VM-execution control field is greater than the value of bits 7:4 of VTPR (see Section 30.1.1).! 


The following items detail the treatment of these VM exits: 


° The VM exits are not blocked if RFLAGS.IF = 0 or by the setting of bits in the interruptibility-state field in guest- 
state area. 


¢ The VM exits follow event injection if such injection is specified for VM entry. 


1. “Virtualize APIC accesses” and “virtual-interrupt delivery” are secondary processor-based VM-execution controls. If bit 31 of the pri- 
mary processor-based VM-execution controls is 0, VM entry functions as if these controls were 0. See Section 25.6.2. 
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¢ VM exits caused by this control take priority over system-management interrupts (SMIs), INIT signals, and 
lower priority events. They thus have priority over the VM exits described in Section 27.7.5, Section 27.7.6, 
and Section 27.7.8, as well as any interrupts or debug exceptions that may be pending at the time of VM entry. 


¢ These VM exits wake the logical processor if it just entered the HLT state as part of a VM entry (see Section 
27.7.2). They do not occur if the logical processor just entered the shutdown state or the wait-for-SIPI state. 


If such a VM exit is suppressed because the processor just entered the shutdown state, it occurs after the 
delivery of any event that cause the logical processor to leave the shutdown state while remaining in VMX 
non-root operation (e.g., due to an NMI that occurs while the “NMI-exiting” VM-execution control is 0). 


¢ The basic exit reason is “TPR below threshold.” 


27.7.8. Pending MTF VM Exits 


As noted in Section 27.6.2, VM entry may cause an MTF VM exit to be pending immediately after VM entry. The 
following items detail the treatment of these VM exits: 


¢ System-management interrupts (SMIs), INIT signals, and higher priority events take priority over these 
VM exits. These VM exits take priority over debug-trap exceptions and lower priority events. 


¢ These VM exits wake the logical processor if it just entered the HLT state because of a VM entry (see Section 
27.7.2). They do not occur if the logical processor just entered the shutdown state or the wait-for-SIPI state. 


27.7.9 VM Entries and Advanced Debugging Features 


VM entries are not logged with last-branch records, do not produce branch-trace messages, and do not update the 
branch-trace store. 


27.7.10 User-Interrupt Recognition After VM Entry 


AVM entry results in recognition of a pending user interrupt if it completes with CR4.UINTR = IA32_EFER.LMA = 1 
and with UIRR # 0; otherwise, no pending user interrupt is recognized. 


27.8 \VM-ENTRY FAILURES DURING OR AFTER LOADING GUEST STATE 


VM-entry failures due to the checks identified in Section 27.3.1 and failures during the MSR loading identified in 
Section 27.4 are treated differently from those that occur earlier in VM entry. In these cases, the following steps 
take place: 


1. Information about the VM-entry failure is recorded in the VM-exit information fields: 
— Exit reason. 


¢ Bits 15:0 of this field contain the basic exit reason. It is loaded with a number indicating the general 
cause of the VM-entry failure. The following numbers are used: 


33. VM-entry failure due to invalid guest state. A VM entry failed one of the checks identified in Section 
27.3.1. 


34. VM-entry failure due to MSR loading. A VM entry failed in an attempt to load MSRs (see Section 
27.4). 


41. VM-entry failure due to machine-check event. A machine-check event occurred during VM entry 
(see Section 27.9). 


¢ Bit 31 is set to 1 to indicate a VM-entry failure. 
¢ The remainder of the field (bits 30:16) is cleared. 
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— Exit qualification. This field is set based on the exit reason. 


¢ VM-entry failure due to invalid guest state. In most cases, the exit qualification is cleared to 0. The 
following non-zero values are used in the cases indicated: 


1. Not used. 
2. Failure was due to a problem loading the PDPTEs (see Section 27.3.1.6). 


3. Failure was due to an attempt to inject a non-maskable interrupt (NMI) into a guest that is blocking 
events through the STI blocking bit in the interruptibility-state field. 


4. Failure was due to an invalid VMCS link pointer (see Section 27.3.1.5). 


VM-entry checks on guest-state fields may be performed in any order. Thus, an indication by exit 
qualification of one cause does not imply that there are not also other errors. Different processors 
may give different exit qualifications for the same VMCS. 


¢ VM-entry failure due to MSR loading. The exit qualification is loaded to indicate which entry in the 
VM-entry MSR-load area caused the problem (1 for the first entry, 2 for the second, etc.). 


— All other VM-exit information fields are unmodified. 


Processor state is loaded as would be done on a VM exit (see Section 28.5). If this results in 
[CR4.PAE & CRO.PG & ~IA32_EFER.LMA] = 1, page-directory-pointer-table entries (PDPTEs) may be checked 
and loaded (see Section 28.5.4). 


The state of blocking by NMI is what it was before VM entry. 
MSRs are loaded as specified in the VM-exit MSR-load area (see Section 28.6). 


Although this process resembles that of a VM exit, many steps taken during a VM exit do not occur for these 
VM-entry failures: 


Most VM-exit information fields are not updated (see step 1 above). 

The valid bit in the VM-entry interruption-information field is not cleared. 
The guest-state area is not modified. 

No MSRs are saved into the VM-exit MSR-store area. 


27.9 MACHINE-CHECK EVENTS DURING VM ENTRY 


If a machine-check event occurs during a VM entry, one of the following occurs: 


The machine-check event is handled as if it occurred before the VM entry: 


— If CR4.MCE = 0, operation of the logical processor depends on whether the logical processor is in SMX 
operation: 


* If the logical processor is in SMX operation, an Intel® TXT shutdown condition occurs. The error code 
used is OOOCH, indicating “unrecoverable machine-check condition.” 


¢ Ifthe logical processor is outside SMX operation, it goes to the shutdown state. 
— If CR4.MCE = 1, a machine-check exception (#MC) is delivered through the IDT. 
The machine-check event is handled after VM entry completes: 


— Ifthe VM entry ends with CR4.MCE = 0, operation of the logical processor depends on whether the logical 
processor is in SMX operation: 


* If the logical processor is in SMX operation, an Intel® TXT shutdown condition occurs with error code 
OOOCH (unrecoverable machine-check condition). 


¢ Ifthe logical processor is outside SMX operation, it goes to the shutdown state. 


A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi- 
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last 
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference,” in the Intel® 64 and IA-32 Architectures Soft- 
ware Developer's Manual, Volume 2D. 
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— Ifthe VM entry ends with CR4.MCE = 1, a machine-check exception (#MC) is generated: 
¢ If bit 18 (#MC) of the exception bitmap is 0, the exception is delivered through the guest IDT. 
¢ If bit 18 of the exception bitmap is 1, the exception causes a VM exit. 


¢ AVM-entry failure occurs as described in Section 27.8. The basic exit reason is 41, for “VM-entry failure due to 
machine-check event.” 


The first option is not used if the machine-check event occurs after any guest state has been loaded. The second 
option is used only if VM entry is able to load all guest state. 
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17.Updates to Chapter 28, Volume 3C 


Change bars and violet text show changes to Chapter 28 of the Inte/® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3C: System Programming Guide, Part 3. 


Changes to this chapter: 

e Updated the information regarding the TPAUSE and UMWAIT instructions in Section 28.2.5, “Information for 
VM Exits Due to Instruction Execution,” including adding Table 28-13, “Format of the VM-Exit Instruction- 
Information Field as Used for TPAUSE and UMWAIT.” 
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CHAPTER 28 
VM ExITS 


VM exits occur in response to certain instructions and events in VMX non-root operation as detailed in Section 26.1 
through Section 26.2. VM exits perform the following operations: 


1. Information about the cause of the VM exit is recorded in the VM-exit information fields and VM-entry control 
fields are modified as described in Section 28.2. 


Processor state is saved in the guest-state area (Section 28.3). 


MSRs may be saved in the VM-exit MSR-store area (Section 28.4). This step is not performed for SMM VM exits 
that activate the dual-monitor treatment of SMIs and SMM. 


4. The following may be performed in parallel and in any order (Section 28.5): 


— Processor state is loaded based in part on the host-state area and some VM-exit controls. This step is not 
performed for SMM VM exits that activate the dual-monitor treatment of SMIs and SMM. See Section 
32.15.6 for information on how processor state is loaded by such VM exits. 


— Address-range monitoring is cleared. 


5. MSRs may be loaded from the VM-exit MSR-load area (Section 28.6). This step is not performed for SMM 
VM exits that activate the dual-monitor treatment of SMIs and SMM. 


VM exits are not logged with last-branch records, do not produce branch-trace messages, and do not update the 
branch-trace store. 


Section 28.1 clarifies the nature of the architectural state before a VM exit begins. The steps described above are 
detailed in Section 28.2 through Section 28.6. 


Section 32.15 describes the dual-monitor treatment of system-management interrupts (SMIs) and system- 
management mode (SMM). Under this treatment, ordinary transitions to SMM are replaced by VM exits to a sepa- 
rate SMM monitor. Called SMM VM exits, these are caused by the arrival of an SMI or the execution of VMCALL in 
VMX root operation. SMM VM exits differ from other VM exits in ways that are detailed in Section 32.15.2. 


28.1 ARCHITECTURAL STATE BEFORE A VM EXIT 


This section describes the architectural state that exists before a VM exit, especially for VM exits caused by events 
that would normally be delivered through the IDT. Note the following: 


¢ Anexception causes a VM exit directly if the bit corresponding to that exception is set in the exception bitmap. 
A non-maskable interrupt (NMI) causes a VM exit directly if the “NMI exiting” VM-execution control is 1. An 
external interrupt causes a VM exit directly if the “external-interrupt exiting” VM-execution control is 1. A start- 
up IPI (SIPI) that arrives while a logical processor is in the wait-for-SIPI activity state causes a VM exit directly. 
INIT signals that arrive while the processor is not in the wait-for-SIPI activity state cause VM exits directly. 


¢ An exception, NMI, external interrupt, or software interrupt causes a VM exit indirectly if it does not do so 
directly but delivery of the event causes a nested exception, double fault, task switch, APIC access (see Section 
30.4), EPT violation, EPT misconfiguration, page-modification log-full event (see Section 29.3.6), or SPP- 
related event (see Section 29.3.4) that causes a VM exit. 


¢ Anevent results in a VM exit if it causes a VM exit (directly or indirectly). 
The following bullets detail when architectural state is and is not updated in response to VM exits: 


° If an event causes a VM exit directly, it does not update architectural state as it would have if it had it not 
caused the VM exit: 


— Adebug exception does not update DR6, DR7, or IA32_DEBUGCTL. (Information about the nature of the 
debug exception is saved in the exit qualification field.) 


— A page fault does not update CR2. (The linear address causing the page fault is saved in the exit-qualifi- 
cation field.) 
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— An NMI causes subsequent NMIs to be blocked, but only after the VM exit completes. 


— Anexternal interrupt does not acknowledge the interrupt controller and the interrupt remains pending, 
unless the “acknowledge interrupt on exit” VM-exit control is 1. In such a case, the interrupt controller is 
acknowledged and the interrupt is no longer pending. 


— The flags LO - L3 in DR7 (bit 0, bit 2, bit 4, and bit 6) are not cleared when a task switch causes a VM exit. 


— Ifatask switch causes a VM exit, none of the following are modified by the task switch: old task-state 
segment (TSS); new TSS; old TSS descriptor; new TSS descriptor; RFLAGS.NT!; or the TR register. 


— No last-exception record is made if the event that would do so directly causes a VM exit. 


— Ifamachine-check exception causes a VM exit directly, this does not prevent machine-check MSRs from 
being updated. These are updated by the machine-check event itself and not the resulting machine-check 
exception. 


— Ifthe logical processor is in an inactive state (see Section 25.4.2) and not executing instructions, some 
events may be blocked but others may return the logical processor to the active state. Unblocked events 
may cause VM exits.2 If an unblocked event causes a VM exit directly, a return to the active state occurs 
only after the VM exit completes.? The VM exit generates any special bus cycle that is normally generated 
when the active state is entered from that activity state. 


MTF VM exits (see Section 26.5.2 and Section 27.7.8) are not blocked in the HLT activity state. If an MTF 
VM exit occurs in the HLT activity state, the logical processor returns to the active state only after the 
VM exit completes. MTF VM exits are blocked the shutdown state and the wait-for-SIPI state. 


e If an event causes a VM exit indirectly, the event does update architectural state: 


— Adebug exception updates DR6, DR7, and the IA32_DEBUGCTL MSR. No debug exceptions are considered 
pending. 


— A page fault updates CR2. 
— An NMI causes subsequent NMIs to be blocked before the VM exit commences. 
— Anexternal interrupt acknowledges the interrupt controller and the interrupt is no longer pending. 


— Ifthe logical processor had been in an inactive state, it enters the active state and, before the VM exit 
commences, generates any special bus cycle that is normally generated when the active state is entered 
from that activity state. 


— There is no blocking by STI or by MOV SS when the VM exit commences. 


— Processor state that is normally updated as part of delivery through the IDT (CS, RIP, SS, RSP, RFLAGS) is 
not modified. However, the incomplete delivery of the event may write to the stack. 


— The treatment of last-exception records is implementation dependent: 


* Some processors make a last-exception record when beginning the delivery of an event through the IDT 
(before it can encounter a nested exception). Such processors perform this update even if the event 
encounters a nested exception that causes a VM exit (including the case where nested exceptions lead 
to a triple fault). 


¢ Other processors delay making a last-exception record until event delivery has reached some event 
handler successfully (perhaps after one or more nested exceptions). Such processors do not update the 
last-exception record if a VM exit or triple fault occurs before an event handler is reached. 


1. This chapter uses the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that support VMX oper- 
ation also support Intel 64 architecture. For processors that do not support Intel 64 architecture, this notation refers to the 32-bit 
forms of those registers (EAX, EIP, ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer specifically to lower 32 
bits of the indicated register. 


2. Ifa\VM exit takes the processor from an inactive state resulting from execution of a specific instruction (HLT or MWAIT), the value 
saved for RIP by that VM exit will reference the following instruction. 


3. An exception is made if the logical processor had been inactive due to execution of MWAIT; in this case, it is considered to have 
become active before the VM exit. 
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¢ If the “virtual NMIs” VM-execution control is 1, VM entry injects an NMI, and delivery of the NMI causes a 
nested exception, double fault, task switch, EPT violation, EPT misconfiguration, page-modification log-full 
event, or SPP-related event, or APIC access that causes a VM exit, virtual-NMI blocking is in effect before the 
VM exit commences. 


° IfaVM exit results from a fault, EPT violation, EPT misconfiguration, page-modification log-full event, or SPP- 
related event that is encountered during execution of IRET and the “NMI exiting” VM-execution control is 0, any 
blocking by NMI is cleared before the VM exit commences. However, the previous state of blocking by NMI may 
be recorded in the exit qualification or in the VM-exit interruption-information field; see Section 28.2.3. 


° IfaVM exit results from a fault, EPT violation, EPT misconfiguration, page-modification log-full event, or SPP- 
related event that is encountered during execution of IRET and the “virtual NMIs” VM-execution control is 1, 
virtual-NMI blocking is cleared before the VM exit commences. However, the previous state of blocking by NMI 
may be recorded in the exit qualification or in the VM-exit interruption-information field; see Section 28.2.3. 


* Suppose that a VM exit is caused directly by an x87 FPU Floating-Point Error (#MF) or by any of the following 
events if the event was unblocked due to (and given priority over) an x87 FPU Floating-Point Error: an INIT 
signal, an external interrupt, an NMI, an SMI; or a machine-check exception. In these cases, there is no 
blocking by STI or by MOV SS when the VM exit commences. 

¢ Normally, a last-branch record may be made when an event is delivered through the IDT. However, if such an 
event results in a VM exit before delivery is complete, no last-branch record is made. 

¢ If machine-check exception results in a VM exit, processor state is suspect and may result in Suspect state 
being saved to the guest-state area. A VM monitor should consult the RIPV and EIPV bits in the 
IA32_MCG_STATUS MSR before resuming a guest that caused a VM exit resulting from a machine-check 
exception. 

° If aVM exit results from a fault, APIC access (see Section 30.4), EPT violation, EPT misconfiguration, page- 
modification log-full event, or SPP-related event that is encountered while executing an instruction, data 
breakpoints due to that instruction may have been recognized and information about them may be saved in the 
pending debug exceptions field (unless the VM exit clears that field; see Section 28.3.4). 


¢ The following VM exits are considered to happen after an instruction is executed: 
— VM exits resulting from debug traps (single-step, I/O breakpoints, and data breakpoints). 


— VM exits resulting from debug exceptions (data breakpoints) whose recognition was delayed by blocking by 
MOV SS. 
— VM exits resulting from some machine-check exceptions. 


— Trap-like VM exits due to execution of MOV to CR8 when the “CR8-load exiting” VM-execution control is 0 
and the “use TPR shadow” VM-execution control is 1 (see Section 30.3). (Such VM exits can occur only from 
64-bit mode and thus only on processors that support Intel 64 architecture.) 


— Trap-like VM exits due to execution of WRMSR when the “use MSR bitmaps” VM-execution control is 1; the 
value of ECX is in the range 800H-8FFH; and the bit corresponding to the ECX value in write bitmap for low 
MSRs is 0; and the “virtualize x2APIC mode” VM-execution control is 1. See Section 30.5. 


— VM exits caused by APIC-write emulation (see Section 30.4.3.2) that result from APIC accesses as part of 
instruction execution. 


For these VM exits, the instruction’s modifications to architectural state complete before the VM exit occurs. 
Such modifications include those to the logical processor’s interruptibility state (see Table 25-3). If there had 
been blocking by MOV SS, POP SS, or STI before the instruction executed, such blocking is no longer in effect. 


AVM exit that occurs in enclave mode sets bit 27 of the exit-reason field and bit 4 of the guest interruptibility-state 
field. Before such a VM exit is delivered, an Asynchronous Enclave Exit (AEX) occurs (see Chapter 37, “Enclave 
Exiting Events”). An AEX modifies architectural state (Section 37.3). In particular, the processor establishes the 
following architectural state as indicated: 


° The following bits in RFLAGS are cleared: CF, PF, AF, ZF, SF, OF, and RF. 

¢ FS and GS are restored to the values they had prior to the most recent enclave entry. 
¢ RIP is loaded with the AEP of interrupted enclave thread. 

¢ RSP is loaded from the URSP field in the enclave’s state-save area (SSA). 
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28.2 RECORDING VM-EXIT INFORMATION AND UPDATING VM-ENTRY CONTROL 
FIELDS 


VM exits begin by recording information about the nature of and reason for the VM exit in the VM-exit information 
fields. Section 28.2.1 to Section 28.2.5 detail the use of these fields. 


In addition to updating the VM-exit information fields, the valid bit (bit 31) is cleared in the VM-entry interruption- 
information field. If bit 5 of the IA32_VMX_MISC MSR (index 485H) is read as 1 (see Appendix A.6), the value of 
IA32_EFER.LMA is stored into the “IA-32e mode guest” VM-entry control. 


28.2.1 Basic VM-Exit Information 


Section 25.9.1 defines the basic VM-exit information fields. The following items detail their use. 
¢ Exit reason. 


— Bits 15:0 of this field contain the basic exit reason. It is loaded with a number indicating the general cause 
of the VM exit. Appendix C lists the numbers used and their meaning. 


— Bit 25 is set if the “prematurely busy shadow stack” VM-exit control is 1 and the VM exit caused a shadow 
stack become prematurely busy (see Section 26.4.3). Otherwise, the bit is cleared. 


— Bit 26 of this field is set to 1 if the VM exit occurred after assertion of a bus lock while the “VMM bus-lock 
detection” VM-execution control was 1. Such VM exits include those that occur due to the 1-setting of that 
control as well as others that might occur during execution of an instruction that asserted a bus lock. 


— Bit 27 of this field is set to 1 if the VM exit occurred while the logical processor was in enclave mode. 


Such VM exits include those caused by interrupts, non-maskable interrupts, system-management 
interrupts, INIT signals, and exceptions occurring in enclave mode as well as exceptions encountered 
during the delivery of such events incident to enclave mode. 


AVM exit also sets this bit if it is incident to delivery of an event injected by VM entry and the guest inter- 
ruptibility-state field indicates an enclave interruption (bit 4 of the field is 1). 


— The remainder of the field (bits 31:28 and bits 24:16) is cleared to 0 (certain SMM VM exits may set some 
of these bits; see Section 32.15.2.3).2 


° Exit qualification. This field is saved for VM exits due to the following causes: debug exceptions; page-fault 
exceptions; start-up IPIs (SIPIs); system-management interrupts (SMIs) that arrive immediately after the 
execution of I/O instructions; task switches; INVEPT; INVLPG; INVPCID; INVVPID; LGDT; LIDT; LLDT; LTR; 
SGDT; SIDT; SLDT; STR; VMCLEAR; VMPTRLD; VMPTRST; VMREAD; VMWRITE; VMXON; WBINVD; 
WBNOINVD; XRSTORS; XSAVES; control-register accesses; MOV DR; I/O instructions; MWAIT; accesses to the 
APIC-access page (see Section 30.4); EPT violations (see Section 29.3.3.2); EOI virtualization (see Section 
30.1.4); APIC-write emulation (see Section 30.4.3.3); page-modification log full (see Section 29.3.6); SPP- 
related events (see Section 29.3.4); and instruction timeout (see Section 26.2). For all other VM exits, this field 
is cleared. The following items provide details: 


— Fora debug exception, the exit qualification contains information about the debug exception. The 
information has the format given in Table 28-1. 


Table 28-1. Exit Qualification for Debug Exceptions 


Bit Position(s) Contents 


3:0 B3 - BO. When set, each of these bits indicates that the corresponding breakpoint condition was met. Any of 
these bits may be set even if its corresponding enabling bit in DR7 is not set. 


10:4 Not currently defined. 


1. Bit 5 of the |A32_VMX_MISC MSR is read as 1 on any logical processor that supports the 1-setting of the “unrestricted guest” VM- 
execution control. 


2. Bit 31 of this field is set on certain VM-entry failures; see Section 27.8. 
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Table 28-1. Exit Qualification for Debug Exceptions (Contd.) 


Bit Position(s) Contents 

11 BLD. When set, this bit indicates that a bus lock was asserted while OS bus-lock detection was enabled and 
CPL > 0 (see Section 18.3.1.6 (“OS Bus-Lock Detection”). 

12 Not currently defined. 

13 BD. When set, this bit indicates that the cause of the debug exception is “debug register access detected.” 

14 BS. When set, this bit indicates that the cause of the debug exception is either the execution of a single 
instruction (if RFLAGS.TF = 1 and |A32_DEBUGCTL.BTF = 0) or a taken branch (if 
RFLAGS.TF = DEBUGCTL.BTF = 1). 

15 Not currently defined. 

16 RTM. When set, this bit indicates that a debug exception (#DB) or a breakpoint exception (HBP) occurred 
inside an RTM region while advanced debugging of RTM transactional regions was enabled (see Section 
16.3.7, “RTM-Enabled Debugger Support,” of the Intel® 64 and IA-32 Architectures Software Developer's 
Manual, Volume 1).2 

63:17 Not currently defined. Bits 63:32 exist only on processors that support Intel 64 architecture. 

NOTES: 


1. In general, the format of this field matches that of DR6. However, DR6 clears bit 11 to indicate detection of a bus lock, while this field 
sets the bit to indicate that condition. 

2. In general, the format of this field matches that of DR6. However, DR6 clears bit 16 to indicate an RTM-related exception, while this 
field sets the bit to indicate that condition. 


— Fora page-fault exception, the exit qualification contains the linear address that caused the page fault. On 
processors that support Intel 64 architecture, bits 63:32 are cleared if the logical processor was not in 64- 
bit mode before the VM exit. 


If the page-fault exception occurred during execution of an instruction in enclave mode (and not during 
delivery of an event incident to enclave mode), bits 11:0 of the exit qualification are cleared. 


— Fora start-up IPI (SIPI), the exit qualification contains the SIPI vector information in bits 7:0. Bits 63:8 of 
the exit qualification are cleared to 0. 


— Fora task switch, the exit qualification contains details about the task switch, encoded as shown in 


Table 28-2. 


— For INVLPG, the exit qualification contains the linear-address operand of the instruction. 


¢* On processors that support Intel 64 architecture, bits 63:32 are cleared if the logical processor was not 
in 64-bit mode before the VM exit. 


¢ Ifthe INVLPG source operand specifies an unusable segment, the linear address specified in the exit 
qualification will match the linear address that the INVLPG would have used if no VM exit occurred. This 
address is not architecturally defined and may be implementation-specific. 


Table 28-2. Exit Qualification for Task Switches 


Bit Position(s) Contents 
15:0 Selector of task-state segment (TSS) to which the guest attempted to switch 
29:16 Not currently defined 
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Table 28-2. Exit Qualification for Task Switches (Contd.) 


Bit Position(s) Contents 


31:30 


Source of task switch initiation: 


0: CALL instruction 
1: IRET instruction 
2: JMP instruction 

3: Task gate in IDT 


63:32 


Not currently defined. These bits exist only on processors that support Intel 64 architecture. 


For INVEPT, INVPCID, INVVPID, LGDT, LIDT, LLDT, LTR, SGDT, SIDT, SLDT, STR, VMCLEAR, VMPTRLD, 
VMPTRST, VMREAD, VMWRITE, VMXON, XRSTORS, and XSAVES, the exit qualification receives the value of 
the instruction’s displacement field, which is sign-extended to 64 bits if necessary (32 bits on processors 
that do not support Intel 64 architecture). If the instruction has no displacement (for example, has a 
register operand), zero is stored into the exit qualification. 


On processors that support Intel 64 architecture, an exception is made for RIP-relative addressing (used 
only in 64-bit mode). Such addressing causes an instruction to use an address that is the sum of the 
displacement field and the value of RIP that references the following instruction. In this case, the exit 
qualification is loaded with the sum of the displacement field and the appropriate RIP value. 


In all cases, bits of this field beyond the instruction’s address size are undefined. For example, suppose 
that the address-size field in the VM-exit instruction-information field (see Section 25.9.4 and Section 
28.2.5) reports an n-bit address size. Then bits 63:n (bits 31:n on processors that do not support Intel 64 
architecture) of the instruction displacement are undefined. 


For a control-register access, the exit qualification contains information about the access and has the 
format given in Table 28-3. 


For MOV DR, the exit qualification contains information about the instruction and has the format given in 
Table 28-4. 


For an J/O instruction, the exit qualification contains information about the instruction and has the format 
given in Table 28-5. 


For MWAIT, the exit qualification contains a value that indicates whether address-range monitoring 
hardware was armed. The exit qualification is set either to 0 (if address-range monitoring hardware is not 
armed) or to 1 (if address-range monitoring hardware is armed). 


WBINVD and WBNOINVD use the same basic exit reason (see Appendix C). For WBINVD, the exit qualifi- 
cation is 0, while for WBNOINVD it is 1. 


For an APIC-access VM exit resulting from a linear access or a guest-physical access to the APIC-access 
page (see Section 30.4), the exit qualification contains information about the access and has the format 
given in Table 28-6.! 


If the access to the APIC-access page occurred during execution of an instruction in enclave mode (and not 
during delivery of an event incident to enclave mode), bits 11:0 of the exit qualification are cleared. 


Such a VM exit that set bits 15:12 of the exit qualification to O000b (data read during instruction execution) 
or 0001b (data write during instruction execution) set bit 12—which distinguishes data read from data 
write—to that which would have been stored in bit 1—W/R—of the page-fault error code had the access 
caused a page fault instead of an APIC-access VM exit. This implies the following: 


¢ For an APIC-access VM exit caused by the CLFLUSH and CLFLUSHOPT instructions, the access type is 
“data read during instruction execution.” 


¢ For an APIC-access VM exit caused by the ENTER instruction, the access type is “data write during 
instruction execution.” 


1. 


The exit qualification is undefined if the access was part of the logging of a branch record or a processor-event-based-sampling 


(PEBS) record to the DS save area. It is recommended that software configure the paging structures so that no address in the DS 
save area translates to an address on the APIC-access page. 
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Table 28-3. Exit Qualification for Control-Register Accesses 


Bit Positions Contents 


3:0 


Number of control register (0 for CLTS and LMSW). Bit 3 is always O on processors that do not support Intel 64 
architecture as they do not support CR8. 


5:4 


Access type: 


0=MOV toCR 

1 = MOV from CR 
2=CLTS 

3 = LMSW 


LMSW operand type: 
O = register 
1 = memory 


For CLTS and MOV CR, cleared to 0 


Not currently defined 


For MOV CR, the general-purpose register: 


8-15 represent R8-R15, respectively (used only on processors that support Intel 64 architecture) 


For CLTS and LMSW, cleared to 0 


15:12 


Not currently defined 


31:16 


For LMSW, the LMSW source data 
For CLTS and MOV CR, cleared to 0 


63:32 


Not currently defined. These bits exist only on processors that support Intel 64 architecture. 


For an APIC-access VM exit caused by the MASKMOVQ instruction or the MASKMOVDQU instruction, the 
access type is “data write during instruction execution.” 


For an APIC-access VM exit caused by the MONITOR instruction, the access type is “data read during 
instruction execution.” 


For an APIC-access VM exit caused directly by an access to a linear address in the DS save area (BTS or 
PEBS), the access type is “linear access for monitoring.” 


For an APIC-access VM exit caused by a guest-physical access performed for an access to the DS save 
area (e.g., to access a paging structure to translate a linear address), the access type is “guest-physical 
access for monitoring or trace.” 


For an APIC-access VM exit caused by trace-address pre-translation (TAPT) when the “Intel PT uses 
guest physical addresses” VM-execution control is 1, the access type is “guest-physical access for 
monitoring or trace.” 


Such a VM exit stores 1 for bit 31 for IDT-vectoring information field (see Section 28.2.4) if and only if it 
sets bits 15:12 of the exit qualification to 0011b (linear access during event delivery) or 1010b (guest- 
physical access during event delivery). 
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See Section 30.4.4 for further discussion of these instructions and APIC-access VM exits. 


For APIC-access VM exits resulting from physical accesses to the APIC-access page (see Section 30.4.6), 
the exit qualification is undefined. 


For an EPT violation, the exit qualification contains information about the access causing the EPT violation 
and has the format given in Table 28-7. 


As noted in that table, the format and meaning of the exit qualification depends on the setting of the 
“mode-based execute control for EPT” VM-execution control and whether the processor supports advanced 
VM-exit information for EPT violations.! 


An EPT violation that occurs during as a result of execution of a read-modify-write operation sets bit 1 (data 
write). Whether it also sets bit 0 (data read) is implementation-specific and, for a given implementation, 


may differ for different kinds of read-modify-write operations. 


Table 28-4. Exit Qualification for MOV DR 


Bit Position(s) | Contents 
2:0 Number of debug register 
3 Not currently defined 
4 Direction of access (O = MOV to DR; 1 = MOV from DR) 
7:5 Not currently defined 
11:8 General-purpose register: 
0 = RAX 
1=RCX 
2 = RDX 
3 = RBX 
4 = RSP 
5 = RBP 
6 = RSI 
7=RDI 
8-15 =R8 - R15, respectively 
63:12 Not currently defined. Bits 63:32 exist only on processors that support Intel 64 architecture. 
Table 28-5. Exit Qualification for I/O Instructions 
Bit Position(s) Contents 
2:0 Size of access: 
0 = 1-byte 
1 = 2-byte 
3 = 4-byte 
Other values not used 
3 Direction of the attempted access (0 = OUT, 1 = IN) 
4 String instruction (O = not string; 1 = string) 


1. Software can determine whether advanced VM-exit information for EPT violations is supported by consulting the VMX capability 


MSR IA32_VMX_EPT_VPID_CAP (see Appendix A.10). 
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Table 28-5. Exit Qualification for I/O Instructions (Contd.) 


Bit Position(s) Contents 


5 REP prefixed (0 = not REP; 1 = REP) 

6 Operand encoding (0 = DX, 1 = immediate) 

15:7 Not currently defined 

31:16 Port number (as specified in DX or in an immediate operand) 

63:32 Not currently defined. These bits exist only on processors that support Intel 64 architecture. 


Table 28-6. Exit Qualification for APIC-Access VM Exits from Linear Accesses and Guest-Physical Accesses 


Bit Position(s) Contents 


11:0 


« If the APIC-access VM exit is due to a linear access, the offset of access within the APIC page. 
« Undefined if the APIC-access VM exit is due a quest-physical access 


15:12 


Access type: 


O = linear access for a data read during instruction execution 

1 = linear access for a data write during instruction execution 

2 = linear access for an instruction fetch 

3 = linear access (read or write) during event delivery 

4 = linear access for monitoring 

10 = guest-physical access during event delivery 

11 = guest-physical access for monitoring or trace 

15 = quest-physical access for an instruction fetch or during instruction execution 


Other values not used 


This bit is set for certain accesses that are asynchronous to instruction execution and not part of event delivery. 
These includes guest-physical accesses related to trace output by Intel PT (see Section 26.5.4), accesses related 
to PEBS on processors with the “EPT-friendly” enhancement (see Section 20.9.5), and accesses that occur during 
user-interrupt delivery (see Section 7.4.2). 


63:17 


Not currently defined. Bits 63:32 exist only on processors that support Intel 64 architecture. 


Bit 12 reports “NMI unblocking due to IRET”; see Section 28.2.3. 


Bit 16 is set for certain accesses that are asynchronous to instruction execution and not part of event 
delivery. These include trace-address pre-translation (TAPT) for Intel PT (see Section 26.5.4), accesses 
related to PEBS on processors with the “EPT-friendly” enhancement (see Section 20.9.5), and accesses as 
part of user-interrupt delivery (see Section 7.4.2). 


For VM exits caused as part of EOI virtualization (Section 30.1.4), bits 7:0 of the exit qualification are set 
to vector of the virtual interrupt that was dismissed by the EOI virtualization. Bits above bit 7 are cleared. 


For APIC-write VM exits (Section 30.4.3.3), bits 11:0 of the exit qualification are set to the page offset of 
the write access that caused the VM exit.! Bits above bit 11 are cleared. 


For a VM exit due to a page-modification log-full event (Section 29.3.6), bit 12 of the exit qualification 
reports “NMI unblocking due to IRET” (see Section 28.2.3). Bit 16 is set if the VM exit occurs during TAPT, 
EPT-friendly PEBS, or user-interrupt delivery. All other bits of the exit qualification are undefined. 


Fora VM exit due to an SPP-related event (Section 29.3.4), bit 11 of the exit qualification indicates the type 
of event: 0 indicates an SPP misconfiguration and 1 indicates an SPP miss. Bit 12 of the exit qualification 


. Execution of WRMSR with ECX = 83FH (self-IPI MSR) can lead to an APIC-write VM exit; the exit qualification for such an APIC-write 
VM exit is 3FOH. 
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reports “NMI unblocking due to IRET” (see Section 28.2.3). Bit 16 is set if the VM exit occurs during TAPT 
EPT-friendly PEBS, or user-interrupt delivery. All other bits of the exit qualification are undefined. 


If the “PASID translation” VM-execution control, PASID translation is performed for executions of the 
ENQCMD and ENQCMDS instructions (see Section 26.5.8). PASID translation may fail, resulting in a 
VM exit. Such a VM exit saves an exit qualification specified in the following items: 


¢ For ENQCMD, the exit qualification is IA32_PASID[19:0]. 


¢ For ENQCMDS, the exit qualification contains the low 32 bits of the instruction’s source operand (which 
had been read from memory prior to PASID translation). 


For a VM exit due to an instruction timeout (Section 26.2), bit 0 indicates (if set) that the context of the 
virtual machine is invalid and that the VM should not be resumed. Bit 12 of the exit qualification reports 
“NMI unblocking due to IRET” (see Section 28.2.3). All other bits of the exit qualification are undefined. 


Guest linear address. For some VM exits, this field receives a linear address that pertains to the VM exit. The 
field is set for different VM exits as follows: 


— VM exits due to attempts to execute LMSW with a memory operand. In these cases, this field receives the 


linear address of that operand. Bits 63:32 are cleared if the logical processor was not in 64-bit mode before 
the VM exit. 


VM exits due to attempts to execute INS or OUTS for which the relevant segment is usable (if the relevant 
segment is not usable, the value is undefined). (ES is always the relevant segment for INS; for OUTS, the 
relevant segment is DS unless overridden by an instruction prefix.) The linear address is the base address 
of relevant segment plus (E)DI (for INS) or (E)SI (for OUTS). Bits 63:32 are cleared if the logical processor 
was not in 64-bit mode before the VM exit. 


Table 28-7. Exit Qualification for EPT Violations 


Bit Position(s) Contents 

0 Set if the access causing the EPT violation was a data read, ! 

1 Set if the access causing the EPT violation was a data write. ! 

2 Set if the access causing the EPT violation was an instruction fetch. 

3 The logical-AND of bit 0 in the EPT paging-structure entries used to translate the quest-physical address of the 
access causing the EPT violation (indicates whether the guest-physical address was readable).2 

4 The logical-AND of bit 1 in the EPT paging-structure entries used to translate the quest-physical address of the 
access causing the EPT violation (indicates whether the guest-physical address was writeable).2 

5 The logical-AND of bit 2 in the EPT paging-structure entries used to translate the quest-physical address of the 
access causing the EPT violation.2 
If the “mode-based execute control for EPT” VM-execution control is 0, this indicates whether the quest-physical 
address was executable. If that control is 1, this indicates whether the quest-physical address was executable 
for supervisor-mode linear addresses. 

6 If the “mode-based execute control” VM-execution control is 0, the value of this bit is undefined. If that control is 
1, this bit is the logical-AND of bit 10 in the EPT paging-structure entries used to translate the guest-physical 
address of the access causing the EPT violation. In this case, it indicates whether the quest-physical address was 
executable for user-mode linear addresses. 

7 Set if the guest linear-address field is valid. 

The guest linear-address field is valid for all EPT violations except those resulting from an attempt to load the 
guest PDPTEs as part of the execution of the MOV CR instruction and those due to trace-address pre-translation 
(TAPT; Section 26.5.4). 
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Table 28-7. Exit Qualification for EPT Violations (Contd.) 


Bit Position(s) 


Contents 


8 


If bit 7 is 1: 

« Set if the access causing the EPT violation is to a quest-physical address that is the translation of a linear 
address. 

* Clear if the access causing the EPT violation is to a paging-structure entry as part of a page walk or the 
update of an accessed or dirty bit. 


Reserved if bit 7 is O (cleared to 0). 


If bit 7 is 1, bit 8 is 1, and the processor supports advanced VM-exit information for EPT violations,‘ this bit is 0 
if the linear address is a supervisor-mode linear address and 1 if it is a user-mode linear address. (If CRO.PG = 0, 
the translation of every linear address is a user-mode linear address and thus this bit will be 1.) Otherwise, this 
bit is undefined. 


If bit 7 is 1, bit 8 is 1, and the processor supports advanced VM-exit information for EPT violations,‘ this bit is 0 
if paging translates the linear address to a read-only page and 1 if it translates to a read/write page. (If CRO.PG = 
O, every linear address is read/write and thus this bit will be 1.) Otherwise, this bit is undefined. 


If bit 7 is 1, bit 8 is 1, and the processor supports advanced VM-exit information for EPT violations,‘ this bit is 0 
if paging translates the linear address to an executable page and 1 if it translates to an execute-disable page. (If 
CRO.PG = 0, CR4.PAE = 0, or IA32_EFER.NXE = 0, every linear address is executable and thus this bit will be 0.) 

Otherwise, this bit is undefined. 


NMI unblocking due to IRET (see Section 28.2.3). 


Set if the access causing the EPT violation was a shadow-stack access. 


15 


If supervisor shadow-stack control is enabled (by setting bit 7 of EPTP), this bit is the same as bit 60 in the EPT 
paging-structure entry that maps the page of the quest-physical address of the access causing the EPT violation. 
Otherwise (or if translation of the quest-physical address terminates before reaching an EPT paging-structure 
entry that maps a page), this bit is undefined. 


This bit is set if the EPT violation was caused as a result of quest-paging verification. See Section 29.3.3.2. 


16 


This bit is set if the access was asynchronous to instruction execution not the result of event delivery. The bit is 
set if the access is related to trace output by Intel PT (see Section 26.5.4), accesses related to PEBS on 
processors with the “EPT-friendly” enhancement (see Section 20.9.5), or to user-interrupt delivery (see Section 
7.4.2). Otherwise, this bit is cleared. 


63:17 


Not currently defined. Bits 63:32 exist only on processors that support Intel 64 architecture. 


NOTES: 


— 


. If accessed and dirty flags for EPT are enabled, processor accesses to quest paging-structure entries are treated as writes with 


regard to EPT violations (see Section 29.3.3.2). If such an access causes an EPT violation, the processor sets both bit O and bit 1 of 
the exit qualification. 

2. Bits 5:3 are cleared to O if either (1) any of EPT paging-structure entries used to translate the guest-physical address of the access 
causing the EPT violation is not present; or (2) 4-level EPT is in use and the guest-physical address sets any bits in the range 51:48 
(see Section 29.3.2). 

3. Bit 6 is cleared to O if (1) the “mode-based execute control” VM-execution control is 1; and (2) either (a) any of EPT paging-structure 
entries used to translate the guest-physical address of the access causing the EPT violation is not present; or (b) 4-level EPT is in use 
and the guest-physical address sets any bits in the range 51:48 (see Section 29.3.2). 

4. Software can determine whether advanced VM-exit information for EPT violations is supported by consulting the VMX capability 
MSR IA32_VMX_EPT_VPID_CAP (see Appendix A.10). 


— VM exits due to EPT violations that set bit 7 of the exit qualification (see Table 28-7; these are all EPT 
violations except those resulting from an attempt to load the PDPTEs as of execution of the MOV CR 
instruction and those due to TAPT). The linear address may translate to the guest-physical address whose 
access caused the EPT violation. Alternatively, translation of the linear address may reference a paging- 
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structure entry whose access caused the EPT violation. Bits 63:32 are cleared if the logical processor was 
not in 64-bit mode before the VM exit. 


If the EPT violation occurred during execution of an instruction in enclave mode (and not during delivery of 
an event incident to enclave mode), bits 11:0 of this field are cleared. 


VM exits due to SPP-related events. 


If the “prematurely busy shadow stack” VM-exit control is 1, certain VM exits (besides those noted above) 
save the linear address that pertains to the VM exit if the VM exit caused a shadow stack to become 
prematurely busy (see Section 26.4.3). This is true for VM exits due for these reasons: EPT misconfigu- 
ration, page-modification log-full event, and instruction timeout. (A VM exit due to instruction timeout that 
sets bit 0 of the exit qualification, indicating that VM context is invalid, does not save a valid linear address. ) 


For all other VM exits, the field is undefined. 


Guest-physical address. For a VM exit due to an EPT violation, an EPT misconfiguration, or an SPP-related 
event, this field receives the guest-physical address that caused the EPT violation or EPT misconfiguration. For 
all other VM exits, the field is undefined. 


If the EPT violation or EPT misconfiguration occurred during execution of an instruction in enclave mode (and 
not during delivery of an event incident to enclave mode), bits 11:0 of this field are cleared. 


28.2.2 Information for VM Exits Due to Vectored Events 


Section 25.9.2 defines fields containing information for VM exits due to the following events: exceptions (including 
those generated by the instructions INT1, INT3, INTO, BOUND, UDO, UD1, and UD2); external interrupts that occur 
while the “acknowledge interrupt on exit” VM-exit control is 1; and non-maskable interrupts (NMIs).! Such 

VM exits include those that occur on an attempt at a task switch that causes an exception before generating the 
VM exit due to the task switch that causes the VM exit. 


The following items detail the use of these fields: 


VM-exit interruption information (format given in Table 25-19). The following items detail how this field is 
established for VM exits due to these events: 


For an exception, bits 7:0 receive the exception vector (at most 31). For an NMI, bits 7:0 are set to 2. For 
an external interrupt, bits 7:0 receive the vector. 


Bits 10:8 are set to O (external interrupt), 2 (non-maskable interrupt), 3 (hardware exception), 5 
(privileged software exception), or 6 (software exception). Hardware exceptions comprise all exceptions 
except the following: 


* Debug exceptions (#DB) generated by the INT1 instruction; these are privileged software exceptions. 
(Other debug exceptions are considered hardware exceptions, as are those caused by executions of 
INT1 in enclave mode.) 


¢ Breakpoint exceptions (#BP; generated by INT3) and overflow exceptions (#OF; generated by INTO); 
these are software exceptions. (A #BP that occurs in enclave mode is considered a hardware 
exception.) 


BOUND-range exceeded exceptions (#BR; generated by BOUND) and invalid opcode exceptions (#UD) 
generated by UDO, UD1, and UD2 are hardware exceptions. 


Bit 11 is set to 1 if the VM exit is caused by a hardware exception that would have delivered an error code 
on the stack. This bit is always 0 if the VM exit occurred while the logical processor was in real-address 
mode (CRO.PE=0).? If bit 11 is set to 1, the error code is placed in the VM-exit interruption error code (see 
below). 


Bit 12 reports “NMI unblocking due to IRET”; see Section 28.2.3. The value of this bit is undefined if the 
VM exit is due to a double fault (the interruption type is hardware exception and the vector is 8). 


INT1 and INT3 refer to the instructions with opcodes F1 and CC, respectively, and not to INT n with value 1 or 3 for n. 

If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX operation, a logical processor cannot be in real- 
address mode unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution con- 
trols are both 1. 
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— Bits 30:13 are always set to 0. 

— Bit 31 is always set to 1. 

For other VM exits (including those due to external interrupts when the “acknowledge interrupt on exit” VM-exit 

control is 0), the field is marked invalid (by clearing bit 31) and the remainder of the field is undefined. 

¢ VM-exit interruption error code. 

— For VM exits that set both bit 31 (valid) and bit 11 (error code valid) in the VM-exit interruption-information 
field, this field receives the error code that would have been pushed on the stack had the event causing the 
VM exit been delivered normally through the IDT. The EXT bit is set in this field exactly when it would be set 
normally. For exceptions that occur during the delivery of double fault (if the IDT-vectoring information field 
indicates a double fault), the EXT bit is set to 1, assuming that (1) that the exception would produce an 


error code normally (if not incident to double-fault delivery) and (2) that the error code uses the EXT bit 
(not for page faults, which use a different format). 


— For other VM exits, the value of this field is undefined. 


28.2.3 Information About NMI Unblocking Due to IRET 
A VM exit may occur during execution of the IRET instruction for reasons including the following: faults, EPT viola- 
tions, page-modification log-full events, SPP-related events, or instruction timeouts. 


An execution of IRET that commences while non-maskable interrupts (NMIs) are blocked will unblock NMIs even if 
a fault or VM exit occurs; the state saved by such a VM exit will indicate that NMIs were not blocked. 


VM exits for the reasons enumerated above provide more information to software by saving a bit called “NMI 
unblocking due to IRET.” This bit is defined if (1) either the “NMI exiting” VM-execution control is 0 or the “virtual 
NMIs” VM-execution control is 1; (2) the VM exit does not set the valid bit in the IDT-vectoring information field 
(see Section 28.2.4); and (3) the VM exit is not due to a double fault. In these cases, the bit is defined as follows: 


¢ The bit is 1 if the VM exit resulted from a memory access as part of execution of the IRET instruction and one 
of the following holds: 


— The “virtual NMIs” VM-execution control is 0 and blocking by NMI (see Table 25-3) was in effect before 
execution of IRET. 


— The “virtual NMIs” VM-execution control is 1 and virtual-NMI blocking was in effect before execution of 
IRET. 


¢ §=The bit is 0 for all other relevant VM exits. 


For VM exits due to faults, NMI unblocking due to IRET is saved in bit 12 of the VM-exit interruption-information 
field (Section 28.2.2). For VM exits due to EPT violations, page-modification log-full events, SPP-related events, 
and instruction timeouts, NMI unblocking due to IRET is saved in bit 12 of the exit qualification (Section 28.2.1). 


(Executions of IRET may also incur VM exits due to APIC accesses and EPT misconfigurations. These VM exits do 
not report information about NMI unblocking due to IRET.) 


28.2.4 Information for VM Exits During Event Delivery 


Section 25.9.3 defined fields containing information for VM exits that occur while delivering an event through the 
IDT and as a result of any of the following cases: 


¢ A fault occurs during event delivery and causes a VM exit (because the bit associated with the fault is set to 1 
in the exception bitmap). 


¢ Atask switch is invoked through a task gate in the IDT. The VM exit occurs due to the task switch only after the 
initial checks of the task switch pass (see Section 26.4.2). 


¢ Event delivery causes an APIC-access VM exit (see Section 30.4). 


1. This includes the case in which a VM exit occurs while delivering a software interrupt (INT n) through the 16-bit IVT (interrupt vec- 
tor table) that is used in virtual-8086 mode with virtual-machine extensions (if RFLAGS.VM = CR4.VME = 1). 
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An EPT violation, EPT misconfiguration, page-modification log-full event, or SPP-related event that occurs 
during event delivery. 


Any of the above VM exits that occur during user-interrupt notification processing (See Section 7.5.2). Such 
VM exits will be treated as if they occurred during delivery of an external interrupt with the vector UINV. 


These fields are used for VM exits that occur during delivery of events injected as part of VM entry (see Section 
27.6.1.2). 


AVM exit is not considered to occur during event delivery in any of the following circumstances: 


The original event causes the VM exit directly (for example, because the original event is a non-maskable 
interrupt (NMI) and the “NMI exiting” VM-execution control is 1). 


The original event results in a double-fault exception that causes the VM exit directly. 
The VM exit occurred as a result of fetching the first instruction of the handler invoked by the event delivery. 
The VM exit is caused by a triple fault. 


The original event was a software interrupt (INT n) executed in virtual-8086 mode with EFLAGS.IOPL < 3 and 
the VM exit was due to a general-protection exception (#GP) that occurred because either CR4.VME = 0 or bit 
n of the software interrupt redirection bit map in the TSS is set. 


The following items detail the use of these fields: 


IDT-vectoring information (format given in Table 25-20). The following items detail how this field is established 
for VM exits that occur during event delivery: 


— Ifthe VM exit occurred during delivery of an exception, bits 7:0 receive the exception vector (at most 31). 
If the VM exit occurred during delivery of an NMI, bits 7:0 are set to 2. If the VM exit occurred during 
delivery of an external interrupt, bits 7:0 receive the vector. 


— Bits 10:8 are set to indicate the type of event that was being delivered when the VM exit occurred: 0 
(external interrupt), 2 (non-maskable interrupt), 3 (hardware exception), 4 (software interrupt), 5 
(privileged software interrupt), or 6 (software exception). 


Hardware exceptions comprise all exceptions except the following:! 


* Debug exceptions (#DB) generated by the INT1 instruction; these are privileged software exceptions. 
(Other debug exceptions are considered hardware exceptions, as are those caused by executions of 
INT1 in enclave mode.) 


¢ Breakpoint exceptions (#BP; generated by INT3) and overflow exceptions (#OF; generated by INTO); 
these are software exceptions. (A #BP that occurs in enclave mode is considered a hardware 
exception.) 


BOUND-range exceeded exceptions (#BR; generated by BOUND) and invalid opcode exceptions (#UD) 
generated by UDO, UD1, and UD2 are hardware exceptions. 


— Bit 11 is set to 1 if the VM exit occurred during delivery of a hardware exception that would have delivered 
an error code on the stack. This bit is always 0 if the VM exit occurred while the logical processor was in 
real-address mode (CRO.PE=0).? If bit 11 is set to 1, the error code is placed in the IDT-vectoring error 
code (see below). 


— Bit 12 is undefined. 

— Bits 30:13 are always set to 0. 

— Bit 31 is always set to 1. 

For other VM exits, the field is marked invalid (by clearing bit 31) and the remainder of the field is undefined. 
IDT-vectoring error code. 


In the following items, INT1 and INT3 refer to the instructions with opcodes F1 and CC, respectively, and not to INT n with value 1 or 
3 for n. 

If the capability MSR IA32_VMX_CRO_FIXEDO reports that CRO.PE must be 1 in VMX operation, a logical processor cannot be in real- 
address mode unless the “unrestricted quest” VM-execution control and bit 31 of the primary processor-based VM-execution con- 
trols are both 1. 
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— For VM exits that set both bit 31 (valid) and bit 11 (error code valid) in the IDT-vectoring information field, 
this field receives the error code that would have been pushed on the stack by the event that was being 
delivered through the IDT at the time of the VM exit. The EXT bit is set in this field when it would be set 
normally. 


— For other VM exits, the value of this field is undefined. 


28.2.5 Information for VM Exits Due to Instruction Execution 


Section 25.9.4 defined fields containing information for VM exits that occur due to instruction execution. (The VM- 
exit instruction length is also used for VM exits that occur during the delivery of a software interrupt or software 
exception.) The following items detail their use. 


VM-exit instruction length. This field is used in the following cases: 


— For fault-like VM exits due to attempts to execute one of the following instructions that cause VM exits 
unconditionally (see Section 26.1.2) or based on the settings of VM-execution controls (see Section 
26.1.3): CLTS, CPUID, ENCLS, GETSEC, HLT, IN, INS, INVD, INVEPT, INVLPG, INVPCID, INVVPID, LGDT, 
LIDT, LLDT, LMSW, LOADIWKEY, LTR, MONITOR, MOV CR, MOV DR, MWAIT, OUT, OUTS, PAUSE, PCONFIG, 
RDMSR, RDPMC, RDRAND, RDSEED, RDTSC, RDTSCP, RSM, SGDT, SIDT, SLDT, STR, TPAUSE, UMWAIT, 
VMCALL, VMCLEAR, VMLAUNCH, VMPTRLD, VMPTRST, VMREAD, VMRESUME, VMWRITE, VMXOFF, VMXON, 
WBINVD, WBNOINVD, WRMSR, XRSTORS, XSETBV, and XSAVES.! 


— For VM exits due to software exceptions (those generated by executions of INT3 or INTO) or privileged 
software exceptions (those generated by executions of INT1). 


— For VM exits due to faults encountered during delivery of a software interrupt, privileged software 
exception, or software exception. 


— For VM exits due to attempts to effect a task switch via instruction execution. These are VM exits that 
produce an exit reason indicating task switch and either of the following: 


¢ An exit qualification indicating execution of CALL, IRET, or JMP instruction. 


¢ An exit qualification indicating a task gate in the IDT and an IDT-vectoring information field indicating 
that the task gate was encountered during delivery of a software interrupt, privileged software 
exception, or software exception. 


— For APIC-access VM exits and for VM exits caused by EPT violations, page-modification log-full events, and 
SPP-related events encountered during delivery of a software interrupt, privileged software exception, or 
software exception.2 


— For VM exits due executions of VMFUNC that fail because one of the following is true: 


¢ EAX indicates a VM function that is not enabled (the bit at position EAX is 0 in the VM-function controls; 
see Section 26.5.6.2). 


¢ EAX = 0 and either ECX > 512 or the value of ECX selects an invalid tentative EPTP value (see Section 
26.5.6.3). 


In all the above cases, this field receives the length in bytes (1-15) of the instruction (including any instruction 
prefixes) whose execution led to the VM exit (see the next paragraph for one exception). 


The cases of VM exits encountered during delivery of a software interrupt, privileged software exception, or 
software exception include those encountered during delivery of events injected as part of VM entry (see 
Section 27.6.1.2). If the original event was injected as part of VM entry, this field receives the value of the VM- 
entry instruction length. 


All VM exits other than those listed in the above items leave this field undefined. 


. This item applies only to fault-like VM exits. It does not apply to trap-like VM exits following executions of the MOV to CR8 instruc- 


tion when the “use TPR shadow” VM-execution control is 1 or to those following executions of the WRMSR instruction when the 
“virtualize x2APIC mode” VM-execution control is 1. 


The VM-exit instruction-length field is not defined following APIC-access VM exits resulting from physical accesses (see Section 
30.4.6) even if encountered during delivery of a software interrupt, privileged software exception, or software exception. 


Vol. 3C 28-15 


VM EXITS 


If the VM exit occurred in enclave mode, this field is cleared (none of the previous items apply). 


Table 28-8. Format of the VM-Exit Instruction-Information Field as Used for INS and OUTS 


Bit Position(s) | Content 


6:0 


Undefined. 


9:7 


Address size: 

0: 16-bit 

1: 32-bit 

2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. 


14:10 


Undefined. 


17:15 


Segment register: 
0: ES 
1:CS 
2:SS 
3: DS 
4: FS 
5: GS 
Other values not used. Undefined for VM exits due to execution of INS. 


31:18 


Undefined. 


° VM-exit instruction information. For VM exits due to attempts to execute INS, INVEPT, INVPCID, INVVPID, 
LIDT, LGDT, LLDT, LOADIWKEY, LTR, OUTS, RDRAND, RDSEED, SIDT, SGDT, SLDT, STR, TPAUSE, UMWAIT, 
VMCLEAR, VMPTRLD, VMPTRST, VMREAD, VMWRITE, VMXON, XRSTORS, or XSAVES, this field receives 
information about the instruction that caused the VM exit. The format of the field depends on the identity of the 
instruction causing the VM exit: 


For VM exits due to attempts to execute INS or OUTS, the field has the format is given in Table 28-8. 


For VM exits due to attempts to execute INVEPT, INVPCID, or INVVPID, the field has the format is given in 
Table 28-9. 


For VM exits due to attempts to execute LIDT, LGDT, SIDT, or SGDT, the field has the format is given in 
Table 28-10. 


For VM exits due to attempts to execute LLDT, LTR, SLDT, or STR, the field has the format is given in 
Table 28-11. 


For VM exits due to attempts to execute RDRAND or RDSEED, the field has the format is given in 
Table 28-12. 


For VM exits due to attempts to execute TPAUSE or UMWAIT, the field has the format is given in 
Table 28-13. 


For VM exits due to attempts to execute VMCLEAR, VMPTRLD, VMPTRST, VMXON, XRSTORS, or XSAVES, 
the field has the format is given in Table 28-14. 


For VM exits due to attempts to execute VMREAD or VMWRITE, the field has the format is given in 
Table 28-15. 


For VM exits due to attempts to execute LOADIWKEY, the field has the format is given in Table 28-16. 


For all other VM exits, the field is undefined, unless the VM exit occurred in enclave mode, in which case the 
field is cleared. 


1. The format of the field was undefined for these VM exits on the first processors to support the virtual-machine extensions. Soft- 
ware can determine whether the format specified in Table 28-8 is used by consulting the VMX capability MSR [A32_VMX_BASIC 
(see Appendix A.1). 
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I/O RCX, I/O RSI, I/O RDI, I/O RIP. These fields are undefined except for SMM VM exits due to system- 
management interrupts (SMIs) that arrive immediately after retirement of I/O instructions. See Section 


32.15.2.3. Note that, if the VM exit occurred in enclave mode, these fields are all cleared. 


Table 28-9. Format of the VM-Exit Instruction-Information Field as Used for INVEPT, INVPCID, and INVVPID 


Bit Position(s) | Content 


1:0 Scaling: 

0: no scaling 

1: scale by 2 

2: scale by 4 

3: scale by 8 (used only on processors that support Intel 64 architecture) 


Undefined for instructions with no index register (bit 22 is set). 


6:2 Undefined. 

9:7 Address size: 
0: 16-bit 
1: 32-bit 


2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. 


10 Cleared to 0. 


14:11 Undefined. 


17:15 Segment register: 
0: ES 


Other values not used. 


21:18 IndexReg: 


8-15 represent R8-R15, respectively (used only on processors that support Intel 64 architecture) 
Undefined for instructions with no index register (bit 22 is set). 


22 IndexReg invalid (0 = valid; 1 = invalid) 
26:23 BaseReg (encoded as IndexReg above) 
Undefined for memory instructions with no base register (bit 27 is set). 
27 BaseReg invalid (0 = valid; 1 = invalid) 
31:28 Reg2 (same encoding as IndexReg above) 
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Table 28-10. Format of the VM-Exit Instruction-Information Field as Used for LIDT, LGDT, SIDT, or SGDT 


Bit Position(s) | Content 


1:0 Scaling: 

0: no scaling 

1: scale by 2 

2: scale by 4 

3: scale by 8 (used only on processors that support Intel 64 architecture) 


Undefined for instructions with no index register (bit 22 is set). 


6:2 Undefined. 

9:7 Address size: 
0: 16-bit 
1: 32-bit 


2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. 


10 Cleared to O. 


11 Operand size: 
0: 16-bit 
1: 32-bit 
Undefined for VM exits from 64-bit mode. 


14:12 Undefined. 


17:15 Segment register: 
0: ES 
1:CS 
2:SS 
3:DS 
4: FS 
5:GS 
Other values not used. 


21:18 IndexReg: 

0 = RAX 

1=RCX 

2 = RDX 

3 = RBX 

4 =RSP 

5 =RBP 

6 = RSI 

7=RDI 

8-15 represent R8-R15, respectively (used only on processors that support Intel 64 architecture) 
Undefined for instructions with no index register (bit 22 is set). 


22 IndexReg invalid (0 = valid; 1 = invalid) 


26:23 BaseReg (encoded as IndexReg above) 
Undefined for instructions with no base register (bit 27 is set). 


27 BaseReg invalid (0 = valid; 1 = invalid) 


29:28 Instruction identity: 


0: SGDT 
1: SIDT 
2: LGDT 
3: LIDT 
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Format of the VM-Exit Instruction-Information Field as Used for LIDT, LGDT, SIDT, or SGDT (Contd.) 


Bit Position(s) 


Content 


31:30 


Undefined. 


Table 28-11. Format of the VM-Exit Instruction-Information Field as Used for LLDT, LTR, SLDT, and STR 


Bit Position(s) | Content 

1:0 Scaling: 
0: no scaling 
1: scale by 2 
2: scale by 4 


3: scale by 8 (used only on processors that support Intel 64 architecture) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no index register (bit 10 is clear 
and bit 22 is set). 


Undefined. 
Reg1: 

0 = RAX 

1=RCX 

2 = RDX 

3 = RBX 

4 =RSP 

5 = RBP 

6 =RSI 

7 =RDI 

8-15 represent R8-R15, respectively (used only on processors that support Intel 64 architecture) 
Undefined for memory instructions (bit 10 is clear). 


9:7 


Address size: 

0: 16-bit 

1: 32-bit 

2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. Undefined for register instructions (bit 10 is set). 


10 


Mem/Reg (0 = memory; 1 = register). 


14:11 


Undefined. 


17:15 


21:18 


Segment register: 
0: ES 
1:¢S 
2:SS 
3: DS 
4: FS 
5: GS 
Other values not used. Undefined for register instructions (bit 10 is set). 


IndexReg (encoded as Reg1 above) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no index register (bit 10 is clear 
and bit 22 is set). 


22 


IndexReg invalid (0 = valid; 1 = invalid) 
Undefined for register instructions (bit 10 is set). 


26:23 


BaseReg (encoded as Reg1 above) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no base register (bit 10 is clear 
and bit 27 is set). 
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Table 28-11. 


Format of the VM-Exit Instruction-Information Field as Used for LLDT, LTR, SLDT, and STR (Contd.) 


Bit Position(s) 


Content 


27 


BaseReg invalid (0 = valid; 1 = invalid) 
Undefined for register instructions (bit 10 is set). 


29:28 


Instruction identity: 


0: SLDT 
1: STR 
2: LLDT 
3: LTR 


31:30 


Undefined. 


Table 28-12. Format of the VM-Exit Instruction-Information Field as Used for RDRAND and RDSEED 


Bit Position(s) 


Content 


2:0 


Undefined. 


6:3 


Operand register (destination register): 

0 = RAX 

1 =RCX 

2 = RDX 

3 = RBX 

4=RSP 

5 = RBP 

6 =RSI 

7 =RDI 

8-15 represent R8-R15, respectively (used only on processors that support Intel 64 architecture) 


10:7 


Undefined. 


12:11 


Operand size: 
0: 16-bit 
1: 32-bit 
2: 64-bit 
The value 3 is not used. 


31:13 


Undefined. 


Table 28-13. Format of the VM-Exit Instruction-Information Field as Used for TPAUSE and UMWAIT 


Bit Position(s) 


Content 


2:0 


Undefined. 


6:3 


Operand register (source register): 

0 = RAX 

1 =RCX 

2 = RDX 

3 = RBX 

4 =RSP 

5 = RBP 

6=RSI 

7 =RDI 

8-15 represent R8-R15, respectively (Used only on processors that support Intel 64 architecture) 


Undefined. 


28-20 Vol. 3C 


VM EXITS 


Table 28-14. Format of the VM-Exit Instruction-Information Field as Used for VMCLEAR, VMPTRLD, VMPTRST, 


VMXON, XRSTORS, and XSAVES 


Bit Position(s) 


Content 


1:0 


Scaling: 
0: no scaling 
1: scale by 2 
2: scale by 4 
3: scale by 8 (used only on processors that support Intel 64 architecture) 


Undefined for instructions with no index register (bit 22 is set). 


6:2 


Undefined. 


9:7 


Address size: 

0: 16-bit 

1: 32-bit 

2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. 


10 


Cleared to O. 


14:11 


Undefined. 


17:15 


21:18 


Segment register: 
0: ES 
1:CS 
2:SS 
3: DS 
4: FS 
5:GS 
Other values not used. 


IndexReg: 

0 = RAX 

1=RCX 

2 = RDX 

3 = RBX 

4=RSP 

5 = RBP 

6=RSI 

7 =RDI 

8-15 represent R8-R15, respectively (Used only on processors that support Intel 64 architecture) 
Undefined for instructions with no index register (bit 22 is set). 


22 


IndexReg invalid (0 = valid; 1 = invalid) 


26:23 


BaseReg (encoded as IndexReg above) 
Undefined for instructions with no base register (bit 27 is set). 


27 


BaseReg invalid (0 = valid; 1 = invalid) 


31:28 


Undefined. 


28.3 


SAVING GUEST STATE 


VM exits save certain components of processor state into corresponding fields in the guest-state area of the VMCS 
(see Section 25.4). On processors that support Intel 64 architecture, the full value of each natural-width field (see 


Section 25.11.2) is saved regardless of the mode of the logical processor before and after the VM exit. 
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Table 28-15. Format of the VM-Exit Instruction-Information Field as Used for VMREAD and VMWRITE 


Bit Position(s) 


Content 


1:0 


Scaling: 
0: no scaling 
1: scale by 2 
2: scale by 4 
3: scale by 8 (used only on processors that support Intel 64 architecture) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no index register (bit 10 is clear 
and bit 22 is set). 


Undefined. 


Reg1: 
0 = RAX 
1 =RCX 


8-15 represent R8-R15, respectively (Used only on processors that support Intel 64 architecture) 
Undefined for memory instructions (bit 10 is clear). 


9:7 


Address size: 

0: 16-bit 

1: 32-bit 

2: 64-bit (used only on processors that support Intel 64 architecture) 
Other values not used. Undefined for register instructions (bit 10 is set). 


10 


Mem/Reg (0 = memory; 1 = register). 


14:11 


Undefined. 


17:15 


Segment register: 
0: ES 


Other values not used. Undefined for register instructions (bit 10 is set). 


21:18 


IndexReg (encoded as Reg1 above) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no index register (bit 10 is clear 
and bit 22 is set). 


22 


IndexReg invalid (0 = valid; 1 = invalid) 
Undefined for register instructions (bit 10 is set). 


26:23 


BaseReg (encoded as Reg1 above) 


Undefined for register instructions (bit 10 is set) and for memory instructions with no base register (bit 10 is clear 
and bit 27 is set). 


27 


BaseReg invalid (0 = valid; 1 = invalid) 
Undefined for register instructions (bit 10 is set). 


31:28 


Reg2 (same encoding as Reg1 above) 


In general, the state saved is that which was in the logical processor at the time the VM exit commences. See 
Section 28.1 for a discussion of which architectural updates occur at that time. 
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Table 28-16. Format of the VM-Exit Instruction-Information Field as Used for LOADIWKEY 


Bit Position(s) | Content 


Undefined. 


6:3 Reg1: identifies the first XMM register operand (KMMO-XMM15; values 8-15 are used only on processors that 
support Intel 64 architecture). 

30:7 Undefined. 

31:28 Reg2: identifies the second XMM register operand (see above). 


Section 28.3.1 through Section 28.3.4 provide details for how various components of processor state are saved. 
These sections reference VMCS fields that correspond to processor state. Unless otherwise stated, these refer- 
ences are to fields in the guest-state area. 


28.3.1 Saving Control Registers, Debug Registers, and MSRs 


Contents of certain control registers, debug registers, and MSRs are saved as follows: 


The contents of CRO, CR3, CR4, and the IA32_SYSENTER_CS, IA32_SYSENTER_ESP, and IA32_SYSENTER_EIP 
MSRs are saved into the corresponding fields. Bits 63:32 of the IA32_SYSENTER_CS MSR are not saved. On 
processors that do not support Intel 64 architecture, bits 63:32 of the IA32_SYSENTER_ESP and 
IA32_SYSENTER_EIP MSRs are not saved. 


If the “save debug controls” VM-exit control is 1, the contents of DR7 and the IA32_DEBUGCTL MSR are saved 
into the corresponding fields. The first processors to support the virtual-machine extensions supported only the 
1-setting of this control and thus always saved data into these fields. 


If the “save IA32_PAT” VM-exit control is 1, the contents of the IA32_PAT MSR are saved into the corresponding 
field. 

If the “save IA32_EFER” VM-exit control is 1, the contents of the IA32_EFER MSR are saved into the corre- 
sponding field. 

If the processor supports either the 1-setting of the “load IA32_BNDCFGS” VM-entry control or that of the 
“clear IA32_BNDCFGS” VM-exit control, the contents of the IA32_ BNDCFGS MSR are saved into the corre- 
sponding field. 

If the processor supports either the 1-setting of the “load IA32_RTIT_CTL” VM-entry control or that of the 
“clear IA32_RTIT_CTL” VM-exit control, the contents of the IA32_RTIT_CTL MSR are saved into the corre- 
sponding field. 

If the processor supports the 1-setting of the “load CET” VM-entry control, the contents of the IA32_S_CET and 
IA32_INTERRUPT_SSP_TABLE_ADDR MSRs are saved into the corresponding fields. On processors that do not 
support Intel 64 architecture, bits 63:32 of these MSRs are not saved. 

If the processor supports either the 1-setting of the “load guest IA32_LBR_CTL” VM-entry control or that of the 
“clear IA32_LBR_CTL” VM-exit control, the contents of the IA32_LBR_CTL MSR are saved into the corre- 
sponding field. 

If the processor supports the 1-setting of the “load PKRS” VM-entry control, the contents of the IA32_PKRS 
MSR are saved into the corresponding field. 

If a processor supports user interrupts, every VM exit saves UINV into the guest UINV field in the VMCS 

(bits 15:8 of the field are cleared). 

If the “save IA32_PERF_GLOBAL_CTL” VM-exit control is 1, the contents of the IA32_PERF_GLOBAL_CTL MSR 
are saved into the corresponding field. 


The value of the SMBASE field is undefined after all VM exits except SMM VM exits. See Section 32.15.2. 


28.3.2 Saving Segment Registers and Descriptor-Table Registers 


For each segment register (CS, SS, DS, ES, FS, GS, LDTR, or TR), the values saved for the base-address, segment- 
limit, and access rights are based on whether the register was unusable (see Section 25.4.1) before the VM exit: 
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e If the register was unusable, the values saved into the following fields are undefined: (1) base address; 
(2) segment limit; and (3) bits 7:0 and bits 15:12 in the access-rights field. The following exceptions apply: 


cs. 

¢ The base-address and segment-limit fields are saved. 

¢ TheL, D, and G bits are saved in the access-rights field. 
Ss. 

¢ DPL is saved in the access-rights field. 


¢* On processors that support Intel 64 architecture, bits 63:32 of the value saved for the base address are 
always zero. 


DS and ES. On processors that support Intel 64 architecture, bits 63:32 of the values saved for the base 
addresses are always zero. 


FS and GS. The base-address field is saved. 
LDTR. The value saved for the base address is always canonical. 


¢ If the register was not unusable, the values saved into the following fields are those which were in the register 
before the VM exit: (1) base address; (2) segment limit; and (3) bits 7:0 and bits 15:12 in access rights. 


¢ Bits 31:17 and 11:8 in the access-rights field are always cleared. Bit 16 is set to 1 if and only if the segment is 
unusable. 


The contents of the GDTR and IDTR registers are saved into the corresponding base-address and limit fields. 


28.3.3. Saving RIP, RSP, RFLAGS, and SSP 
The contents of the RIP, RSP, RFLAGS, and SSP (shadow-stack pointer) registers are saved as follows: 


¢ The value saved in the RIP field is determined by the nature and cause of the VM exit: 


If the VM exit occurred in enclave mode, the value saved is the AEP of interrupted enclave thread (the 
remaining items do not apply). 


If the VM exit occurs due to by an attempt to execute an instruction that causes VM exits unconditionally or 
that has been configured to cause a VM exit via the VM-execution controls, the value saved references that 
instruction. 


If the VM exit is caused by an occurrence of an INIT signal, a start-up IPI (SIPI), or system-management 
interrupt (SMI), the value saved is that which was in RIP before the event occurred. 


If the VM exit occurs due to the 1-setting of either the “interrupt-window exiting” VM-execution control or 
the “NMI-window exiting” VM-execution control, the value saved is that which would be in the register had 
the VM exit not occurred. 


If the VM exit is due to an external interrupt, non-maskable interrupt (NMI), or hardware exception (as 
defined in Section 28.2.2), the value saved is the return pointer that would have been saved (either on the 
stack had the event been delivered through a trap or interrupt gate,‘ or into the old task-state segment had 
the event been delivered through a task gate). 


If the VM exit is due to a triple fault, the value saved is the return pointer that would have been saved 
(either on the stack had the event been delivered through a trap or interrupt gate, or into the old task-state 
segment had the event been delivered through a task gate) had delivery of the double fault not 
encountered the nested exception that caused the triple fault. 


If the VM exit is due to a software exception (due to an execution of INT3 or INTO) or a privileged software 
exception (due to an execution of INT1), the value saved references the INT3, INTO, or INT1 instruction 
that caused that exception. 


1. The reference here is to the full value of RIP before any truncation that would occur had the stack width been only 32 bits or 16 


bits. 
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— Suppose that the VM exit is due to a task switch that was caused by execution of CALL, IRET, or JMP or by 
execution of a software interrupt (INT n), software exception (due to execution of INT3 or INTO), or 
privileged software exception (due to execution of INT1) that encountered a task gate in the IDT. The value 
saved references the instruction that caused the task switch (CALL, IRET, JMP, INT n, INT3, INTO, INT1). 


— Suppose that the VM exit is due to a task switch that was caused by a task gate in the IDT that was 
encountered for any reason except the direct access by a software interrupt or software exception. The 
value saved is that which would have been saved in the old task-state segment had the task switch 
completed normally. 


— Ifthe VM exit is due to an execution of MOV to CR8 or WRMSR that reduced the value of bits 7:4 of VIPR 
(see Section 30.1.1) below that of TPR threshold VM-execution control field (see Section 30.1.2), the value 
saved references the instruction following the MOV to CR8 or WRMSR. 


— Ifthe VM exit was caused by APIC-write emulation (see Section 30.4.3.2) that results from an APIC access 
as part of instruction execution, the value saved references the instruction following the one whose 
execution caused the APIC-write emulation. 


The contents of the RSP register are saved into the RSP field. 


With the exception of the resume flag (RF; bit 16), the contents of the RFLAGS register is saved into the 
RFLAGS field. RFLAGS.RF is saved as follows: 


— Ifthe VM exit occurred in enclave mode, the value saved is 0 (the remaining items do not apply). 


— Ifthe VM exit is caused directly by an event that would normally be delivered through the IDT, the value 
saved is that which would appear in the saved RFLAGS image (either that which would be saved on the 
stack had the event been delivered through a trap or interrupt gate! or into the old task-state segment had 
the event been delivered through a task gate) had the event been delivered through the IDT. See below for 
VM exits due to task switches caused by task gates in the IDT. 


— Ifthe VM exit is caused by a triple fault, the value saved is that which the logical processor would have in 
RF in the RFLAGS register had the triple fault taken the logical processor to the shutdown state. 


— Ifthe VM exit is caused by a task switch (including one caused by a task gate in the IDT), the value saved 
is that which would have been saved in the RFLAGS image in the old task-state segment (TSS) had the task 
switch completed normally without exception. 


— Ifthe VM exit is caused by an attempt to execute an instruction that unconditionally causes VM exits or one 
that was configured to do with a VM-execution control, the value saved is 0.2 


— For APIC-access VM exits and for VM exits caused by EPT violations, EPT misconfigurations, page-modifi- 
cation log-full events, or SPP-related events, the value saved depends on whether the VM exit occurred 
during delivery of an event through the IDT: 


¢ Ifthe VM exit stored 0 for bit 31 for IDT-vectoring information field (because the VM exit did not occur 
during delivery of an event through the IDT; see Section 28.2.4), the value saved is 1. 


¢ Ifthe VM exit stored 1 for bit 31 for IDT-vectoring information field (because the VM exit did occur 
during delivery of an event through the IDT), the value saved is the value that would have appeared in 
the saved RFLAGS image had the event been delivered through the IDT (see above). 


— For all other VM exits, the value saved is the value RFLAGS.RF had before the VM exit occurred. 


If the processor supports the 1-setting of the “load CET” VM-entry control, the contents of the SSP register are 
saved into the SSP field. 


. The reference here is to the full value of RFLAGS before any truncation that would occur had the stack width been only 32 bits or 

16 bits. 

. This is true even if RFLAGS.RF was 1 before the instruction was executed. If, in response to such a VM exit, a VM monitor re-enters 
the guest to re-execute the instruction that caused the VM exit (for example, after clearing the VM-execution control that caused 

the VM exit), the instruction may encounter a code breakpoint that has already been processed. A VM monitor can avoid this by set- 
ting the quest value of RFLAGS.RF to 1 before resuming guest software. 
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28.3.4 Saving Non-Register State 


Information corresponding to guest non-register state is saved as follows: 


* The activity-state field is saved with the logical processor’s activity state before the VM exit. See Section 28.1 
for details of how events leading to a VM exit may affect the activity state. If the VM exit occurred during user- 
interrupt notification processing (see Section 7.5.2) and the logical processor would have entered the HLT state 
following user-interrupt notification processing, the saved activity state is “HLT”. 


¢ The interruptibility-state field is saved to reflect the logical processor’s interruptibility before the VM exit. 


See Section 28.1 for details of how events leading to a VM exit may affect this state. 


VM exits that end outside system-management mode (SMM) save bit 2 (blocking by SMI) as 0 regardless 
of the state of such blocking before the VM exit. 


Bit 3 (blocking by NMI) is treated specially if the “virtual NMIs” VM-execution control is 1. In this case, the 
value saved for this field does not indicate the blocking of NMIs but rather the state of virtual-NMI blocking. 


Bit 4 (enclave interruption) is set to 1 if the VM exit occurred while the logical processor was in enclave 
mode. 


Such VM exits includes those caused by interrupts, non-maskable interrupts, system-management 
interrupts, INIT signals, and exceptions occurring in enclave mode as well as exceptions encountered 
during the delivery of such events incident to enclave mode. 


A VM exit that is incident to delivery of an event injected by VM entry leaves this bit unmodified. 


¢ The pending debug exceptions field is saved as clear for all VM exits except the following: 


A VM exit caused by an INIT signal, a machine-check exception, or a system-management interrupt (SMI). 


A VM exit with basic exit reason “TPR below threshold”, “virtualized EOI”, “APIC write”, “monitor trap flag,” 
or “bus-lock detected.” 


A VM exit due to trace-address pre-translation (TAPT; see Section 26.5.4) or due to accesses related to 
PEBS on processors with the “EPT-friendly” enhancement (see Section 20.9.5). Such VM exits can have 
basic exit reason “APIC access,” “EPT violation,” “EPT misconfiguration,” “page-modification log full,” or 
“SPP-related event.” When due to TAPT or PEBS, these VM exits (with the exception of those due to EPT 
misconfigurations) set bit 16 of the exit qualification, indicating that they are asynchronous to instruction 
execution and not part of event delivery. 


VM exits that are not caused by debug exceptions and that occur while there is MOV-SS blocking of debug 
exceptions. 


For VM exits that do not clear the field, the value saved is determined as follows: 


Each of bits 3:0 may be set if it corresponds to a matched breakpoint. This may be true even if the corre- 
sponding breakpoint is not enabled in DR7. 


Suppose that a VM exit is due to an INIT signal, a machine-check exception, or an SMI; or that a VM exit 
has basic exit reason “TPR below threshold” or “monitor trap flag.” In this case, the value saved sets bits 
corresponding to the causes of any debug exceptions that were pending at the time of the VM exit. 


If the VM exit occurs immediately after VM entry, the value saved may match that which was loaded on 
VM entry (see Section 27.7.3). Otherwise, the following items apply: 


¢ Bit 12 (enabled breakpoint) is set to 1 in any of the following cases: 
— If there was at least one matched data or I/O breakpoint that was enabled in DR7. 


— If it had been set on VM entry, causing there to be valid pending debug exceptions (see Section 
27.7.3) and the VM exit occurred before those exceptions were either delivered or lost. 


— Ifthe XBEGIN instruction was executed immediately before the VM exit and advanced debugging of 
RTM transactional regions had been enabled (see Section 16.3.7, “RTM-Enabled Debugger 


1. If this activity state was an inactive state resulting from execution of a specific instruction (HLT or MWAIT), the value saved for RIP 
by that VM exit will reference the following instruction. 


2. This item includes VM exits that occur as a result of certain VM entries (Section 27.7.7). 
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Support,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1). (This does 
not apply to VM exits with basic exit reason “monitor trap flag.”) 


— Ifa bus lock was asserted while CPL > 0 and OS bus-lock detection was enabled. 
In other cases, bit 12 is cleared to 0. 
Bit 14 (BS) is set if RFLAGS.TF = 1 in either of the following cases: 


— IA32_DEBUGCTL.BTF = 0 and the cause of a pending debug exception was the execution of a single 
instruction. 

— JIA32_DEBUGCTL.BTF = 1 and the cause of a pending debug exception was a taken branch. 

Bit 16 (RTM) is set if a debug exception (#DB) or a breakpoint exception (#BP) occurred inside an RTM 


region while advanced debugging of RTM transactional regions had been enabled. (This does not apply 
to VM exits with basic exit reason “monitor trap flag.”) 


Suppose that a VM exit is due to another reason (but not a debug exception) and occurs while there is MOV- 
SS blocking of debug exceptions. In this case, the value saved sets bits corresponding to the causes of any 
debug exceptions that were pending at the time of the VM exit. If the VM exit occurs immediately after 
VM entry (no instructions were executed in VMX non-root operation), the value saved may match that 
which was loaded on VM entry (see Section 27.7.3). Otherwise, the following items apply: 


Bit 12 (enabled breakpoint) is set to 1 if there was at least one matched data or I/O breakpoint that was 
enabled in DR7. Bit 12 is also set if it had been set on VM entry, causing there to be valid pending debug 
exceptions (see Section 27.7.3) and the VM exit occurred before those exceptions were either delivered 
or lost. In other cases, bit 12 is cleared to 0. 


The setting of bit 14 (BS) is implementation-specific. However, it is not set if RFLAGS.TF = 0 or 
IA32_DEBUGCTL.BTF = 1. 


The reserved bits in the field are cleared. 


If the “save VMX-preemption timer value” VM-exit control is 1, the value of timer is saved into the VMX- 
preemption timer-value field. This is the value loaded from this field on VM entry as subsequently decremented 
(see Section 26.5.1). VM exits due to timer expiration save the value 0. Other VM exits may also save the value 
0 if the timer expired during VM exit. (If the “save VMX-preemption timer value” VM-exit control is 0, VM exit 
does not modify the value of the VMX-preemption timer-value field. ) 


If the logical processor supports the 1-setting of the “enable EPT” VM-execution control, values are saved into 
the four (4) PDPTE fields as follows: 


If the “enable EPT” VM-execution control is 1 and the logical processor was using PAE paging at the time of 
the VM exit, the PDPTE values currently in use are saved: 


The values saved into bits 11:9 of each of the fields is undefined. 


If the value saved into one of the fields has bit 0 (present) clear, the value saved into bits 63:1 of that 
field is undefined. That value need not correspond to the value that was loaded by VM entry or to any 
value that might have been loaded in VMX non-root operation. 


If the value saved into one of the fields has bit 0 (present) set, the value saved into bits 63:12 of the 
field is a guest-physical address. 


If the “enable EPT” VM-execution control is 0 or the logical processor was not using PAE paging at the time 
of the VM exit, the values saved are undefined. 


1. 


A logical processor uses PAE paging if CRO.PG = 1, CR4.PAE = 1 and IA32_EFER.LMA = 0. See Section 4.4 in the Intel® 64 and IA-32 
Architectures Software Developer's Manual, Volume 3A. “Enable EPT” is a secondary processor-based VM-execution control. If bit 31 
of the primary processor-based VM-execution controls is 0, VM exit functions as if the “enable EPT” VM-execution control were 0. 
See Section 25.6.2. 
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28.4 SAVING MSRS 


After processor state is saved to the guest-state area, values of MSRs may be stored into the VM-exit MSR-store 
area (see Section 25.7.2). Specifically each entry in that area (up to the number specified in the VM-exit MSR-store 
count) is processed in order by storing the value of the MSR indexed by bits 31:0 (as they would be read by 
RDMSR) into bits 127:64. Processing of an entry fails in either of the following cases: 


° The value of bits 31:8 is OOO008H, meaning that the indexed MSR is one that allows access to an APIC register 
when the local APIC is in x2APIC mode. 


¢ The value of bits 31:0 indicates an MSR that can be read only in system-management mode (SMM) and the 
VM exit will not end in SMM. (IA32_SMBASE is an MSR that can be read only in SMM.) 


° The value of bits 31:0 indicates an MSR that cannot be saved on VM exits for model-specific reasons. A 
processor may prevent certain MSRs (based on the value of bits 31:0) from being stored on VM exits, even if 
they can normally be read by RDMSR. Such model-specific behavior is documented in Chapter 2, “Model- 
Specific Registers (MSRs),” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4. 


° Bits 63:32 of the entry are not all 0. 


e An attempt to read the MSR indexed by bits 31:0 would cause a general-protection exception if executed via 
RDMSR with CPL = 0. 


A VMX abort occurs if processing fails for any entry. See Section 28.7. 


28.5 LOADING HOST STATE 


Processor state is updated on VM exits in the following ways: 

* Some state is loaded from or otherwise determined by the contents of the host-state area. 
* Some state is determined by VM-exit controls. 

¢ Some state is established in the same way on every VM exit. 

¢ The page-directory pointers are loaded based on the values of certain control registers. 
This loading may be performed in any order. 


On processors that support Intel 64 architecture, the full values of each 64-bit field loaded (for example, the base 
address for GDTR) is loaded regardless of the mode of the logical processor before and after the VM exit. 


The loading of host state is detailed in Section 28.5.1 to Section 28.5.5. These sections reference VMCS fields that 
correspond to processor state. Unless otherwise stated, these references are to fields in the host-state area. 


A logical processor is in IA-32e mode after a VM exit only if the “host address-space size” VM-exit control is 1. If the 
logical processor was in IA-32e mode before the VM exit and this control is 0, a VMX abort occurs. See Section 
28.7. 


In addition to loading host state, VM exits clear address-range monitoring (Section 28.5.6). 


After the state loading described in this section, VM exits may load MSRs from the VM-exit MSR-load area (see 
Section 28.6). This loading occurs only after the state loading described in this section. 


28.5.1 Loading Host Control Registers, Debug Registers, MSRs 


VM exits load new values for controls registers, debug registers, and some MSRs: 


* CRO, CR3, and CR4 are loaded from the CRO field, the CR3 field, and the CR4 field, respectively, with the 
following exceptions: 


— The following bits are not modified: 


¢ For CRO, ET, CD, NW; bits 63:32 (on processors that support Intel 64 architecture), 28:19, 17, and 
15:6; and any bits that are fixed in VMX operation (see Section 24.8).! 


¢ For CR3, bits 63:52 and bits in the range 51:32 beyond the processor's physical-address width (they 
are cleared to 0). (This item applies only to processors that support Intel 64 architecture. ) 
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¢ For CR4, any bits that are fixed in VMX operation (see Section 24.8). 
— CR4.PAE is set to 1 if the “host address-space size” VM-exit control is 1. 
— CR4.PCIDE is set to 0 if the “host address-space size” VM-exit control is 0. 
DR7 is set to 400H. 
If the “clear UINV” VM-exit control is 1, VM exit clears UINV. 
The following MSRs are established as follows: 
— The IA32_DEBUGCTL MSR is cleared to 00000000_O0000000H. 


— The IA32_SYSENTER_CS MSR is loaded from the IA32_SYSENTER_CS field. Since that field has only 32 
bits, bits 63:32 of the MSR are cleared to O. 


— The IA32_SYSENTER_ESP and IA32_SYSENTER_EIP MSRs are loaded from the IA32_SYSENTER_ESP and 
IA32_SYSENTER_EIP fields, respectively. 
If the processor does not support the Intel 64 architecture, these fields have only 32 bits; bits 63:32 of the 
MSRs are cleared to 0. 


If the processor supports the Intel 64 architecture with N < 64 linear-address bits, each of bits 63:N is set 
to the value of bit N-1.1 


— The following steps are performed on processors that support Intel 64 architecture: 


* The MSRs FS.base and GS.base are loaded from the base-address fields for FS and GS, respectively 
(see Section 28.5.2). 


¢ The LMA and LME bits in the IA32_EFER MSR are each loaded with the setting of the “host address- 
space size” VM-exit control. 


— Ifthe “load IA32_PERF_GLOBAL_CTRL” VM-exit control is 1, the IA32_PERF_GLOBAL_CTRL MSR is loaded 
from the IA32_PERF_GLOBAL_CTRL field. Bits that are reserved in that MSR are maintained with their 
reserved values. 


— If the “load IA32_PAT” VM-exit control is 1, the IA32_PAT MSR is loaded from the IA32_PAT field. Bits that 
are reserved in that MSR are maintained with their reserved values. 


— If the “load IA32_EFER” VM-exit control is 1, the IA32_EFER MSR is loaded from the IA32_EFER field. Bits 
that are reserved in that MSR are maintained with their reserved values. 


— Ifthe “clear IA32_BNDCFGS” VM-exit control is 1, the IA32_BNDCFGS MSR is cleared to 
00000000_00000000H,; otherwise, it is not modified. 


— If the “clear IA32_RTIT_CTL” VM-exit control is 1, the IA32_RTIT_CTL MSR is cleared to 
00000000_00000000H; otherwise, it is not modified. 


— Ifthe “load CET” VM-exit control is 1, the IA32_S_CET and IA32_INTERRUPT_SSP_TABLE_ADDR MSRs are 
loaded from the IA32_S_CET and IA32_INTERRUPT_SSP_TABLE_ADDR fields, respectively. 


If the processor does not support the Intel 64 architecture, these fields have only 32 bits; bits 63:32 of the 
MSRs are cleared to 0. 


If the processor supports the Intel 64 architecture with N < 64 linear-address bits, each of bits 63:N is set 
to the value of bit N-1. 


— Ifthe “load PKRS” VM-exit control is 1, the IA32_PKRS MSR is loaded from the IA32_PKRS field. Bits 63:32 
of that MSR are maintained with zeroes. 


With the exception of FS.base and GS.base, any of these MSRs is subsequently overwritten if it appears in the 
VM-exit MSR-load area. See Section 28.6. 


. Bits 28:19, 17, and 15:6 of CRO and CRO.ET are unchanged by executions of MOV to CRO. CRO.ET is always 1 and the other bits are 


always 0. 


. Software can determine a processor's physical-address width by executing CPUID with 8OOOO0O8H in EAX. The physical-address 


width is returned in bits 7:0 of EAX. 


. Software can determine the number N by executing CPUID with 80000008H in EAX. The number of linear-address bits supported is 
returned in bits 15:8 of EAX. 
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28.5.2 Loading Host Segment and Descriptor-Table Registers 


Each of the registers CS, SS, DS, ES, FS, GS, and TR is loaded as follows (see below for the treatment of LDTR): 


¢ The selector is loaded from the selector field. The segment is unusable if its selector is loaded with zero. The 
checks specified in Section 27.2.3 limit the selector values that may be loaded. In particular, CS and TR are 
never loaded with zero and are thus never unusable. SS can be loaded with zero only on processors that 
support Intel 64 architecture and only if the VM exit is to 64-bit mode (64-bit mode allows use of segments 
marked unusable). 


° The base address is set as follows: 
— CS. Cleared to zero. 
— SS, DS, and ES. Undefined if the segment is unusable; otherwise, cleared to zero. 


— FS and GS. Undefined (but, on processors that support Intel 64 architecture, canonical) if the segment is 
unusable and the VM exit is not to 64-bit mode; otherwise, loaded from the base-address field. 


If the processor supports the Intel 64 architecture and the processor supports N < 64 linear-address bits, 
each of bits 63:N is set to the value of bit N-1.! The values loaded for base addresses for FS and GS are 
also manifest in the FS.base and GS.base MSRs. 


— TR. Loaded from the host-state area. If the processor supports the Intel 64 architecture and the processor 
supports N < 64 linear-address bits, each of bits 63:N is set to the value of bit N-1. 


° The segment limit is set as follows: 
— CS. Set to FFFFFFFFH (corresponding to a descriptor limit of FFFFFH and a G-bit setting of 1). 
— SS, DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, set to FFFFFFFFH. 
— TR. Set to 00000067H. 

° The type field and S bit are set as follows: 
— CS. Type set to 11 and S set to 1 (execute/read, accessed, non-conforming code segment). 


— SS, DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, type set to 3 and S set to 1 
(read/write, accessed, expand-up data segment). 


— TR. Type set to 11 and S set to 0 (busy 32-bit task-state segment). 
¢ The DPL is set as follows: 
— CS, SS, and TR. Set to 0. The current privilege level (CPL) will be 0 after the VM exit completes. 
— DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, set to 0. 
° The P bit is set as follows: 
— CS, TR. Set to 1. 
— SS, DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, set to 1. 


* On processors that support Intel 64 architecture, CS.L is loaded with the setting of the “host address-space 
size” VM-exit control. Because the value of this control is also loaded into IA32_EFER.LMA (see Section 28.5.1), 
no VM exit is ever to compatibility mode (which requires IA32_EFER.LMA = 1 and CS.L = 0). 


° D/B. 


— CS. Loaded with the inverse of the setting of the “host address-space size” VM-exit control. For example, if 
that control is 0, indicating a 32-bit guest, CS.D/B is set to 1. 


— SS. Set to 1. 
— DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, set to 1. 
— TR. Set to 0. 


1. Software can determine the number N by executing CPUID with 8OOOO008H in EAX. The number of linear-address bits supported is 
returned in bits 15:8 of EAX. 
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— CS. Setto 1. 
— SS, DS, ES, FS, and GS. Undefined if the segment is unusable; otherwise, set to 1. 
— TR. Set to 0. 


The host-state area does not contain a selector field for LDTR. LDTR is established as follows on all VM exits: the 
selector is cleared to OOOOH, the segment is marked unusable and is otherwise undefined (although the base 
address is always canonical). 


The base addresses for GDTR and IDTR are loaded from the GDTR base-address field and the IDTR base-address 
field, respectively. If the processor supports the Intel 64 architecture and the processor supports N < 64 linear- 
address bits, each of bits 63:N of each base address is set to the value of bit N-1 of that base address. The GDTR 
and IDTR limits are each set to FFFFH. 


28.5.3. Loading Host RIP, RSP, RFLAGS, and SSP 


RIP and RSP are loaded from the RIP field and the RSP field, respectively. RFLAGS is cleared, except bit 1, which is 
always set. 


If the “load CET” VM-exit control is 1, SSP (shadow-stack pointer) is loaded from the SSP field. 


28.5.4 Checking and Loading Host Page-Directory-Pointer-Table Entries 


If CRO.PG = 1, CR4.PAE = 1, and IA32_EFER.LMA = 0, the logical processor uses PAE paging. See Section 4.4 of 
the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.! When in PAE paging is in use, the 
physical address in CR3 references a table of page-directory-pointer-table entries (PDPTEs). A MOV to CR3 
when PAE paging is in use checks the validity of the PDPTEs and, if they are valid, loads them into the processor 
(into internal, non-architectural registers). 


A VM exit is to a VMM that uses PAE paging if (1) bit 5 (corresponding to CR4.PAE) is set in the CR4 field in the 
host-state area of the VMCS; and (2) the “host address-space size” VM-exit control is 0. Such a VM exit may check 
the validity of the PDPTEs referenced by the CR3 field in the host-state area of the VMCS. Such a VM exit must 
check their validity if either (1) PAE paging was not in use before the VM exit; or (2) the value of CR3 is changing 
as a result of the VM exit. A VM exit to a VMM that does not use PAE paging must not check the validity of the 
PDPTEs. 


A VM exit that checks the validity of the PDPTEs uses the same checks that are used when CR3 is loaded with 
MOV to CR3 when PAE paging is in use. If MOV to CR3 would cause a general-protection exception due to the 
PDPTEs that would be loaded (e.g., because a reserved bit is set), a VMX abort occurs (see Section 28.7). If a 
VM exit to a VMM that uses PAE does not cause a VMX abort, the PDPTEs are loaded into the processor as would 
MOV to CR3, using the value of CR3 being load by the VM exit. 


28.5.5 Updating Non-Register State 


VM exits affect the non-register state of a logical processor as follows: 
¢ A logical processor is always in the active state after a VM exit. 
¢ Event blocking is affected as follows: 

— There is no blocking by STI or by MOV SS after a VM exit. 


— VM exits caused directly by non-maskable interrupts (NMIs) cause blocking by NMI (see Table 25-3). Other 
VM exits do not affect blocking by NMI. (See Section 28.1 for the case in which an NMI causes a VM exit 
indirectly.) 


° There are no pending debug exceptions after a VM exit. 


1. On processors that support Intel 64 architecture, the physical-address extension may support more than 36 physical-address bits. 
Software can determine a processor's physical-address width by executing CPUID with 80000008H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 
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Section 29.4 describes how the VMX architecture controls how a logical processor manages information in the TLBs 
and paging-structure caches. The following items detail how VM exits invalidate cached mappings: 


e If the “enable VPID” VM-execution control is 0, the logical processor invalidates linear mappings and combined 
mappings associated with VPID OOOOH (for all PCIDs); combined mappings for VPID OOOOH are invalidated for 
all EPTRTA values (EPTRTA is the value of bits 51:12 of EPTP). 


¢ VM exits are not required to invalidate any guest-physical mappings, nor are they required to invalidate any 
linear mappings or combined mappings if the “enable VPID” VM-execution control is 1. 


28.5.6 Clearing Address-Range Monitoring 


The Intel 64 and IA-32 architectures allow software to monitor a specified address range using the MONITOR and 
MWAIT instructions. See Section 9.10.4 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3A. VM exits clear any address-range monitoring that may be in effect. 


28.6 LOADING MSRS 


VM exits may load MSRs from the VM-exit MSR-load area (see Section 25.7.2). Specifically each entry in that area 

(up to the number specified in the VM-exit MSR-load count) is processed in order by loading the MSR indexed by 

bits 31:0 with the contents of bits 127:64 as they would be written by WRMSR. 

Processing of an entry fails in any of the following cases: 

¢ The value of bits 31:0 is either CO000100H (the IA32_FS_BASE MSR) or C0000101H (the IA32_GS_BASE 
MSR). 

¢ The value of bits 31:8 is OO0008H, meaning that the indexed MSR is one that allows access to an APIC register 
when the local APIC is in x2APIC mode. 

¢ The value of bits 31:0 indicates an MSR that can be written only in system-management mode (SMM) and the 
VM exit will not end in SMM. (IA32_SMM_MONITOR_CTL is an MSR that can be written only in SMM.) 


¢ The value of bits 31:0 indicates an MSR that cannot be loaded on VM exits for model-specific reasons. A 
processor may prevent loading of certain MSRs even if they can normally be written by WRMSR. Such model- 
specific behavior is documented in Chapter 2, “Model-Specific Registers (MSRs),” in the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 4. 


° Bits 63:32 are not all 0. 


¢ Anattempt to write bits 127:64 to the MSR indexed by bits 31:0 of the entry would cause a general-protection 
exception if executed via WRMSR with CPL = 0.! 


If processing fails for any entry, a VMX abort occurs. See Section 28.7. 


If any MSR is being loaded in such a way that would architecturally require a TLB flush, the TLBs are updated so 
that, after VM exit, the logical processor does not use any translations that were cached before the transition. 


28.7 VMX ABORTS 


A problem encountered during a VM exit leads to a VMX abort. A VMX abort takes a logical processor into a shut- 
down state as described below. 


AVMxX abort does not modify the VMCS data in the VMCS region of any active VMCS. The contents of these data are 
thus suspect after the VMX abort. 


On a VMX abort, a logical processor saves a nonzero 32-bit VMX-abort indicator field at byte offset 4 in the VMCS 
region of the VMCS whose misconfiguration caused the failure (see Section 25.2). The following values are used: 


1. Note the following about processors that support Intel 64 architecture. If CRO.PG = 1, WRMSR to the I[A32_EFER MSR causes a gen- 
eral-protection exception if it would modify the LME bit. Since CRO.PG is always 1 in VMX operation, the IA32_EFER MSR should not 
be included in the VM-exit MSR-load area for the purpose of modifying the LME bit. 
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There was a failure in saving guest MSRs (see Section 28.4). 
Host checking of the page-directory-pointer-table entries (PDPTEs) failed (see Section 28.5.4). 


The current VMCS has been corrupted (through writes to the corresponding VMCS region) in such a way that 
the logical processor cannot complete the VM exit properly. 


There was a failure on loading host MSRs (see Section 28.6). 
5. There was a machine-check event during VM exit (see Section 28.8). 


The logical processor was in IA-32e mode before the VM exit and the “host address-space size” VM-exit control 
was 0 (see Section 28.5). 


Some of these causes correspond to failures during the loading of state from the host-state area. Because the 
loading of such state may be done in any order (see Section 28.5) a VM exit that might lead to a VMX abort for 
multiple reasons (for example, the current VMCS may be corrupt and the host PDPTEs might not be properly 
configured). In such cases, the VMX-abort indicator could correspond to any one of those reasons. 


A logical processor never reads the VMX-abort indicator in a VMCS region and writes it only with one of the non- 
zero values mentioned above. The VMX-abort indicator allows software on one logical processor to diagnose the 
VMxX-abort on another. For this reason, it is recommended that software running in VMX root operation zero the 
VMxX-abort indicator in the VMCS region of any VMCS that it uses. 


After saving the VMX-abort indicator, operation of a logical processor experiencing a VMX abort depends on 
whether the logical processor is in SMX operation:! 


* If the logical processor is in SMX operation, an Intel® TXT shutdown condition occurs. The error code used is 
OOODH, indicating “VMX abort.” See the Intel® Trusted Execution Technology Measured Launched Environment 
Programming Guide. 


¢ If the logical processor is outside SMX operation, it issues a special bus cycle (to notify the chipset) and enters 
the VMX-abort shutdown state. RESET is the only event that wakes a logical processor from the VMX-abort 
shutdown state. The following events do not affect a logical processor in this state: machine-check events; 
INIT signals; external interrupts; non-maskable interrupts (NMIs); start-up IPIs (SIPIs); and system- 
management interrupts (SMIs). 


28.8 MACHINE-CHECK EVENTS DURING VM EXIT 


If a machine-check event occurs during VM exit, one of the following occurs: 
¢ The machine-check event is handled as if it occurred before the VM exit: 


— If piboueen = 0, operation of the logical processor depends on whether the logical processor is in SMX 
operation: 


* If the logical processor is in SMX operation, an Intel® TXT shutdown condition occurs. The error code 
used is OOOCH, indicating “unrecoverable machine-check condition.” 


¢ Ifthe logical processor is outside SMX operation, it goes to the shutdown state. 
— If CR4.MCE = 1, a machine-check exception (#MC) is generated: 
¢ If bit 18 (#MC) of the exception bitmap is 0, the exception is delivered through the guest IDT. 
¢ If bit 18 of the exception bitmap is 1, the exception causes a VM exit. 
¢ The machine-check event is handled after VM exit completes: 


— Ifthe VM exit ends with CR4.MCE = 0, operation of the logical processor depends on whether the logical 
processor is in SMX operation: 


1. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi- 
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last 
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference,” in Intel® 64 and IA-32 Architectures Software 
Developer's Manual, Volume 2D. 
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* If the logical processor is in SMX operation, an Intel® TXT shutdown condition occurs with error code 
OOOCH (unrecoverable machine-check condition). 


¢ If the logical processor is outside SMX operation, it goes to the shutdown state. 
— Ifthe VM exit ends with CR4.MCE = 1, a machine-check exception (#MC) is delivered through the host IDT. 


e AVMX abort is generated (see Section 28.7). The logical processor blocks events as done normally in 
VMX abort. The VMX abort indicator is 5, for “machine-check event during VM exit.” 


The first option is not used if the machine-check event occurs after any host state has been loaded. The second 
option is used only if VM entry is able to load all host state. 


28.9 USER-INTERRUPT RECOGNITION AFTER VM EXIT 


AVM exit results in recognition of a pending user interrupt if it completes with CR4.UINTR = IA32_EFER.LMA = 1 
and with UIRR # 0; otherwise, no pending user interrupt is recognized. 
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18.Updates to Chapter 32, Volume 3C 


Change bars and violet text show changes to Chapter 32 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 3C: System Programming Guide, Part 3. 


Changes to this chapter: 


e Updated the information regarding CR4 in Section 32.15.6.5, “Loading Host State,” to add that LA57 is cleared 
in addition to MCE, PGE, CET, and PCIDE. 
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CHAPTER 32 
SYSTEM MANAGEMENT MODE 


This chapter describes aspects of IA-64 and IA-32 architecture used in system management mode (SMM). 


SMM provides an alternate operating environment that can be used to monitor and manage various system 
resources for more efficient energy usage, to control system hardware, and/or to run proprietary code. It was 
introduced into the IA-32 architecture in the Intel386 SL processor (a mobile specialized version of the Intel386 
processor). It is also available in the Pentium M, Pentium 4, Intel Xeon, P6 family, and Pentium and Intel486 
processors (beginning with the enhanced versions of the Intel486 SL and Intel486 processors). 


32.1 SYSTEM MANAGEMENT MODE OVERVIEW 


SMM is a special-purpose operating mode provided for handling system-wide functions like power management, 
system hardware control, or proprietary OEM-designed code. It is intended for use only by system firmware, not by 
applications software or general-purpose systems software. The main benefit of SMM is that it offers a distinct and 
easily isolated processor environment that operates transparently to the operating system or executive and soft- 
ware applications. 


When SMM is invoked through a system management interrupt (SMI), the processor saves the current state of the 
processor (the processor’s context), then switches to a separate operating environment defined by a new address 
space. The system management software executive (SMI handler) starts execution in that environment, and the 
critical code and data of the SMI handler reside in a physical memory region (GMRAM) within that address space. 
While in SMM, the processor executes SMI handler code to perform operations such as powering down unused disk 
drives or monitors, executing proprietary code, or placing the whole system in a suspended state. When the SMI 
handler has completed its operations, it executes a resume (RSM) instruction. This instruction causes the processor 
to reload the saved context of the processor, switch back to protected or real mode, and resume executing the 
interrupted application or operating-system program or task. 


The following SMM mechanisms make it transparent to applications programs and operating systems: 
¢ The only way to enter SMM is by means of an SMI. 


¢ The processor executes SMM code in a separate address space that can be made inaccessible from the other 
operating modes. 


¢ Upon entering SMM, the processor saves the context of the interrupted program or task. 
¢ All interrupts normally handled by the operating system are disabled upon entry into SMM. 
¢ The RSM instruction can be executed only in SMM. 


Section 32.3 describes transitions into and out of SMM. The execution environment after entering SMM is in real- 
address mode with paging disabled (CRO.PE = CRO.PG = 0). In this initial execution environment, the SMI handler 
can address up to 4 GBytes of memory and can execute all I/O and system instructions. Section 32.5 describes in 
detail the initial SMM execution environment for an SMI handler and operation within that environment. The SMI 
handler may subsequently switch to other operating modes while remaining in SMM. 


NOTES 


Software developers should be aware that, even if a logical processor was using the physical- 
address extension (PAE) mechanism (introduced in the P6 family processors) or was in IA-32e 
mode before an SMI, this will not be the case after the SMI is delivered. This is because delivery of 
an SMI disables paging (see Table 32-4). (This does not apply if the dual-monitor treatment of SMIs 
and SMM is active; see Section 32.15.) 
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32.1.1 System Management Mode and VMX Operation 


Traditionally, SMM services system management interrupts and then resumes program execution (back to the soft- 
ware stack consisting of executive and application software; see Section 32.2 through Section 32.13). 


A virtual machine monitor (VMM) using VMX can act as a host to multiple virtual machines and each virtual machine 
can support its own software stack of executive and application software. On processors that support VMX, virtual- 
machine extensions may use system-management interrupts (SMIs) and system-management mode (SMM) in one 
of two ways: 


° Default treatment. System firmware handles SMIs. The processor saves architectural states and critical 
states relevant to VMX operation upon entering SMM. When the firmware completes servicing SMIs, it uses 
RSM to resume VMX operation. 


¢ Dual-monitor treatment. Two VM monitors collaborate to control the servicing of SMIs: one VMM operates 
outside of SMM to provide basic virtualization in support for guests; the other VMM operates inside SMM (while 
in VMX operation) to support system-management functions. The former is referred to as executive monitor, 
the latter SMM-transfer monitor (STM).! 


The default treatment is described in Section 32.14, “Default Treatment of SMIs and SMM with VMX Operation and 
SMX Operation.” Dual-monitor treatment of SMM is described in Section 32.15, “Dual-Monitor Treatment of SMIs 
and SMM.” 


32.2 SYSTEM MANAGEMENT INTERRUPT (SMI) 


The only way to enter SMM is by signaling an SMI through the SMI# pin on the processor or through an SMI 
message received through the APIC bus. The SMI is a nonmaskable external interrupt that operates independently 
from the processor’s interrupt- and exception-handling mechanism and the local APIC. The SMI takes precedence 
over an NMI and a maskable interrupt. SMM is non-reentrant; that is, the SMI is disabled while the processor is in 
SMM. 


NOTES 


In the Pentium 4, Intel Xeon, and P6 family processors, when a processor that is designated as an 
application processor during an MP initialization sequence is waiting for a startup IPI (SIPI), it is in 
a mode where SMIs are masked. However if a SMI is received while an application processor is in 
the wait for SIPI mode, the SMI will be pended. The processor then responds on receipt of a SIPI by 
immediately servicing the pended SMI and going into SMM before handling the SIPI. 


An SMI may be blocked for one instruction following execution of STI, MOV to SS, or POP into SS. 


32.3. SWITCHING BETWEEN SMM AND THE OTHER PROCESSOR OPERATING 
MODES 


Figure 2-3 shows how the processor moves between SMM and the other processor operating modes (protected, 
real-address, and virtual-8086). Signaling an SMI while the processor is in real-address, protected, or virtual-8086 
modes always causes the processor to switch to SMM. Upon execution of the RSM instruction, the processor always 
returns to the mode it was in when the SMI occurred. 


32.3.1 Entering SMM 


The processor always handles an SMI on an architecturally defined “interruptible” point in program execution 
(which is commonly at an IA-32 architecture instruction boundary). When the processor receives an SMI, it waits 
for all instructions to retire and for all stores to complete. The processor then saves its current context in SMRAM 
(see Section 32.4), enters SMM, and begins to execute the SMI handler. 


1. The dual-monitor treatment may not be supported by all processors. Software should consult the VMX capability MSR IA32_VMX- 
_BASIC (see Appendix A.1) to determine whether it is supported. 
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Upon entering SMM, the processor signals external hardware that SMI handling has begun. The signaling mecha- 
nism used is implementation dependent. For the P6 family processors, an SMI acknowledge transaction is gener- 
ated on the system bus and the multiplexed status signal EXF4 is asserted each time a bus transaction is generated 
while the processor is in SMM. For the Pentium and Intel486 processors, the SMIACT# pin is asserted. 


An SMI has a greater priority than debug exceptions and external interrupts. Thus, if an NMI, maskable hardware 
interrupt, or a debug exception occurs at an instruction boundary along with an SMI, only the SMI is handled. 
Subsequent SMI requests are not acknowledged while the processor is in SMM. The first SMI interrupt request that 
occurs while the processor is in SMM (that is, after SMM has been acknowledged to external hardware) is latched 
and serviced when the processor exits SMM with the RSM instruction. The processor will latch only one SMI while 
in SMM. 


See Section 32.5 for a detailed description of the execution environment when in SMM. 


32.3.2 Exiting From SMM 


The only way to exit SMM is to execute the RSM instruction. The RSM instruction is only available to the SMI 
handler; if the processor is not in SMM, attempts to execute the RSM instruction result in an invalid-opcode excep- 
tion (#UD) being generated. 


The RSM instruction restores the processor’s context by loading the state save image from SMRAM back into the 
processor’s registers. The processor then returns an SMIACK transaction on the system bus and returns program 
control back to the interrupted program. 


NOTE 


On processors that support the shadow-stack feature, RSM loads the SSP register from the state 
save image in SMRAM (see Table 32-3). The value is made canonical by sign-extension before 
loading it into SSP. 


Upon successful completion of the RSM instruction, the processor signals external hardware that SMM has been 
exited. For the P6 family processors, an SMI acknowledge transaction is generated on the system bus and the 
multiplexed status signal EXF4 is no longer generated on bus cycles. For the Pentium and Intel486 processors, the 
SMIACT# pin is deserted. 


If the processor detects invalid state information saved in the SMRAM, it enters the shutdown state and generates 
a special bus cycle to indicate it has entered shutdown state. Shutdown happens only in the following situations: 


¢ Areserved bit in control register CR4 is set to 1 on a write to CR4. This error should not happen unless SMI 
handler code modifies reserved areas of the SMRAM saved state map (see Section 32.4.1). CR4 is saved in the 
state map in a reserved location and cannot be read or modified in its saved state. 


¢ An illegal combination of bits is written to control register CRO, in particular PG set to 1 and PE set to 0, or NW 
set to 1 and CD set to 0. 


° CR4.PCIDE would be set to 1 and IA32_EFER.LMA to O. 


¢ (For the Pentium and Intel486 processors only.) If the address stored in the SMBASE register when an RSM 
instruction is executed is not aligned on a 32-KByte boundary. This restriction does not apply to the P6 family 
processors. 


® CR4.CET would be set to 1 and CRO.WP to O. 


In the shutdown state, Intel processors stop executing instructions until a RESET#, INIT# or NMI# is asserted. 
While Pentium family processors recognize the SMI# signal in shutdown state, P6 family and Intel486 processors 
do not. Intel does not support using SMI# to recover from shutdown states for any processor family; the response 
of processors in this circumstance is not well defined. On Pentium 4 and later processors, shutdown will inhibit INTR 
and A20M but will not change any of the other inhibits. On these processors, NMIs will be inhibited if no action is 
taken in the SMI handler to uninhibit them (see Section 32.8). 


If the processor is in the HALT state when the SMI is received, the processor handles the return from SMM slightly 
differently (see Section 32.10). Also, the SMBASE address can be changed on a return from SMM (see Section 
32.11). 
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32.4 SMRAM 


Upon entering SMM, the processor switches to a new address space. Because paging is disabled upon entering 
SMM, this initial address space maps all memory accesses to the low 4 GBytes of the processor's physical address 
space. The SMI handler's critical code and data reside in a memory region referred to as system-management RAM 
(SMRAM). The processor uses a pre-defined region within SMRAM to save the processor's pre-SMI context. SMRAM 
can also be used to store system management information (such as the system configuration and specific informa- 
tion about powered-down devices) and OEM-specific information. 


The default SMRAM size is 64 KBytes beginning at a base physical address in physical memory called the SMBASE 
(see Figure 32-1). The SMBASE default value following a hardware reset is 30000H. The processor looks for the 
first instruction of the SMI handler at the address [SMBASE + 8000H]. It stores the processor’s state in the area 
from [SMBASE + FEQOH] to [SMBASE + FFFFH]. See Section 32.4.1 for a description of the mapping of the state 
save area. 


The system logic is minimally required to decode the physical address range for the SMRAM from [SMBASE + 
8000H] to [SMBASE + FFFFH]. A larger area can be decoded if needed. The size of this SMRAM can be between 32 
KBytes and 4 GBytes. 


The location of the SMRAM can be changed by changing the SMBASE value (see Section 32.11). It should be noted 
that all processors in a multiple-processor system are initialized with the same SMBASE value (30000H). Initializa- 
tion software must sequentially place each processor in SMM and change its SMBASE so that it does not overlap 
those of other processors. 


The actual physical location of the SMRAM can be in system memory or in a separate RAM memory. The processor 
generates an SMI acknowledge transaction (P6 family processors) or asserts the SMIACT# pin (Pentium and 
Intel486 processors) when the processor receives an SMI (see Section 32.3.1). 


System logic can use the SMI acknowledge transaction or the assertion of the SMIACT# pin to decode accesses to 
the SMRAM and redirect them (if desired) to specific SMRAM memory. If a separate RAM memory is used for 
SMRAM, system logic should provide a programmable method of mapping the SMRAM into system memory space 
when the processor is not in SMM. This mechanism will enable start-up procedures to initialize the SMRAM space 
(that is, load the SMI handler) before executing the SMI handler during SMM. 


32.4.1 SMRAM State Save Map 


When an IA-32 processor that does not support Intel 64 architecture initially enters SMM, it writes its state to the 
state save area of the SMRAM. The state save area begins at [SMBASE + 8000H + 7FFFH] and extends down to 
[SMBASE + 8000H + 7EOOH]. Table 32-1 shows the state save map. The offset in column 1 is relative to the 
SMBASE value plus 8000H. Reserved spaces should not be used by software. 


Some of the registers in the SMRAM state save area (marked YES in column 3) may be read and changed by the 
SMI handler, with the changed values restored to the processor registers by the RSM instruction. Some register 
images are read-only, and must not be modified (modifying these registers will result in unpredictable behavior). 
An SMI handler should not rely on any values stored in an area that is marked as reserved. 


SMRAM 


SMBASE + FFFFH 
Start of State Save Area 


SMI Handler Entry Point 
SMBASE + 8000H 


SMBASE 


Figure 32-1. SMRAM Usage 
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Offset Register Writable? 
(Added to SMBASE + 8000H) 
7FFCH CRO No 
7FF8H CR3 No 
7FF4H EFLAGS Yes 
7FFOH EIP Yes 
7FECH EDI Yes 
7FE8H ESI Yes 
7FE4H EBP Yes 
7FEOH ESP Yes 
7FDCH EBX Yes 
7FD8H EDX Yes 
7FD4H ECX Yes 
7FDOH EAX Yes 
7FCCH DR6 No 
7FC8H DR7 No 
7FC4H TR! No 
7FCOH Reserved No 
7FBCH cs! No 
7FB8H Fs! No 
7FB4H Ds! No 
7FBOH ss! No 
7FACH cs! No 
7FA8H es! No 
7FA4H I/O State Field, see Section 32.7 No 
7FAOH 1/0 Memory Address Field, see Section 32.7 No 
7F9FH-7F03H Reserved No 
7F02H Auto HALT Restart Field (Word) Yes 
7FOOH I/O Instruction Restart Field (Word) Yes 
7EFCH SMM Revision Identifier Field (Doubleword) No 
7EF8H SMBASE Field (Doubleword) Yes 
7€F7H - 7E00H Reserved No 


NOTE: 


1. The two most significant bytes are reserved. 


The following registers are saved (but not readable) and restored upon exiting SMM: 


* Control register CR4. (This register is cleared to all Os when entering SMM). 


° The hidden segment descriptor information stored in segment registers CS, DS, ES, FS, GS, and SS. 


If an SMI request is issued for the purpose of powering down the processor, the values of all reserved locations in 
the SMM state save must be saved to nonvolatile memory. 


The following state is not automatically saved and restored following an SMI and the RSM instruction, respectively: 
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* Debug registers DRO through DR3. 

¢ The x87 FPU registers. 

° The MTRRs. 

* Control register CR2. 

¢ The model-specific registers (for the P6 family and Pentium processors) or test registers TR3 through TR7 (for 
the Pentium and Intel486 processors). 

¢ The state of the trap controller. 

¢ The machine-check architecture registers. 

¢ The APIC internal interrupt state (ISR, IRR, etc.). 

¢ The microcode update state. 


If an SMI is used to power down the processor, a power-on reset will be required before returning to SMM, which 
will reset much of this state back to its default values. So an SMI handler that is going to trigger power down should 
first read these registers listed above directly, and save them (along with the rest of RAM) to nonvolatile storage. 
After the power-on reset, the continuation of the SMI handler should restore these values, along with the rest of 
the system's state. Anytime the SMI handler changes these registers in the processor, it must also save and restore 
them. 


NOTES 


A small subset of the MSRs (such as, the time-stamp counter and performance-monitoring 
counters) are not arbitrarily writable and therefore cannot be saved and restored. SMM-based 
power-down and restoration should only be performed with operating systems that do not use or 
rely on the values of these registers. 

Operating system developers should be aware of this fact and ensure that their operating-system 
assisted power-down and restoration software is immune to unexpected changes in these register 
values. 


32.4.1.1 SMRAM State Save Map and Intel 64 Architecture 


When the processor initially enters SMM, it writes its state to the state save area of the SMRAM. The state save area 
on an Intel 64 processor at [SMBASE + 8000H + 7FFFH] and extends to [SMBASE + 8000H + 7COOH]. 


Support for Intel 64 architecture is reported by CPUID.80000001:EDX[29] = 1. The layout of the SMRAM state save 
map is shown in Table 32-3. 


Additionally, the SMRAM state save map shown in Table 32-3 also applies to processors with the following CPUID 
signatures listed in Table 32-2, irrespective of the value in CPUID.80000001:EDX[29]. 


Table 32-2. Processor Signatures and 64-bit SMRAM State Save Map Format 


DisplayFamily_DisplayModel | Processor Families/Processor Number Series 

06_17H Intel Xeon Processor 5200, 5400 series, Intel Core 2 Quad processor Q9xxx, Intel Core 2 Duo 
processors E8000, T9000, 

06_OFH Intel Xeon Processor 3000, 3200, 5100, 5300, 7300 series, Intel Core 2 Quad, Intel Core 2 Extreme, 
Intel Core 2 Duo processors, Intel Pentium dual-core processors 

06_1CH 45 nm Intel Atom® processors 
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Offset Register Writable? 
(Added to SMBASE + 8000H) 
7FF8H CRO No 
7FFOH CR3 No 
7FE8H RFLAGS Yes 
7FEOH IA32_EFER Yes 
7FD8H RIP Yes 
7FDOH DR6 No 
7FC8H DR7 No 
7FC4H TR SEL! No 
7FCOH LDTR SEL! No 
7FBCH Gs seu! No 
7FB8H FS SEL! No 
7FB4H Ds SEL! No 
7FBOH SS SEL! No 
7FACH cs Set! No 
7FASH ES SEL! No 
7FA4H IO_MISC No 
7F9CH IO_MEM_ADDR No 
7F94H RDI Yes 
7F8CH RSI Yes 
7F84H RBP Yes 
7F7CH RSP Yes 
7F74H RBX Yes 
7F6CH RDX Yes 
7F64H RCX Yes 
7F5CH RAX Yes 
7F54H R8 Yes 
7F4CH RO Yes 
7F44H R10 Yes 
7F3CH R11 Yes 
7F34H R12 Yes 
7F2CH R13 Yes 
7F24H R14 Yes 
7F1CH R15 Yes 
7F1BH-7FO4H Reserved No 
7FO02H Auto HALT Restart Field (Word) Yes 
7FOOH I/O Instruction Restart Field (Word) Yes 
7EFCH SMM Revision Identifier Field (Doubleword) No 
7EF8H SMBASE Field (Doubleword) Yes 
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Table 32-3. SMRAM State Save Map for Intel 64 Architecture (Contd.) 


NOTE: 


1. The two most significant bytes are reserved. 


32.4.2 SMRAM Caching 


An IA-32 processor does not automatically write back and invalidate its caches before entering SMM or before 


exiting SMM. Because of this behavior, care must be taken in the placement of the SMRAM in system memory and 


Offset Register Writable? 
(Added to SMBASE + 8000H) 
7EF7H - 7EE4H Reserved No 
7EEOH Setting of “enable EPT” VM-execution control No 
7€D8H Value of EPTP VM-execution control field No 
7€D7H - 7ECCOH Reserved No 
7EC8H SSP Yes 
7EC7H - 7EAOH Reserved No 
7E9CH LDT Base (lower 32 bits) No 
7€98H Reserved No 
7E94H IDT Base (lower 32 bits) No 
7€90H Reserved No 
7E8CH GDT Base (lower 32 bits) No 
7E8BH - 7E48H Reserved No 
7E40H CR4 (64 bits) No 
7€3FH - 7DFOH Reserved No 
7DE8H IO_RIP Yes 
7DE7H - 7DDCH Reserved No 
7DD8H IDT Base (Upper 32 bits) No 
7DD4H LDT Base (Upper 32 bits) No 
7DDOH GDT Base (Upper 32 bits) No 
7DCFH - 7COOH Reserved No 


in the caching of the SMRAM to prevent cache incoherence when switching back and forth between SMM and 


protected mode operation. Any of the following three methods of locating the SMRAM in system memory will guar- 


antee cache coherency. 


¢ Place the SMRAM in a dedicated section of system memory that the operating system and applications are 
prevented from accessing. Here, the SMRAM can be designated as cacheable (WB, WT, or WC) for optimum 


processor performance, without risking cache incoherence when entering or exiting SMM. 


¢ Place the SMRAM ina section of memory that overlaps an area used by the operating system (such as the video 
memory), but designate the SMRAM as uncacheable (UC). This method prevents cache access when in SMM to 


maintain cache coherency, but the use of uncacheable memory reduces the performance of SMM code. 


¢ Place the SMRAM in a section of system memory that overlaps an area used by the operating system and/or 


application code, but explicitly flush (write back and invalidate) the caches upon entering and exiting SMM 
mode. This method maintains cache coherency, but incurs the overhead of two complete cache flushes. 


For Pentium 4, Intel Xeon, and P6 family processors, a combination of the first two methods of locating the SMRAM 


is recommended. Here the SMRAM is split between an overlapping and a dedicated region of memory. Upon 


entering SMM, the SMRAM space that is accessed overlaps video memory (typically located in low memory). This 
SMRAM section is designated as UC memory. The initial SMM code then jumps to a second SMRAM section that is 
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located in a dedicated region of system memory (typically in high memory). This SMRAM section can be cached for 
optimum processor performance. 


For systems that explicitly flush the caches upon entering SMM (the third method described above), the cache flush 
can be accomplished by asserting the FLUSH# pin at the same time as the request to enter SMM (generally initi- 
ated by asserting the SMI# pin). The priorities of the FLUSH# and SMI¥# pins are such that the FLUSH# is serviced 
first. To guarantee this behavior, the processor requires that the following constraints on the interaction of FLUSH# 
and SMI# be met. In a system where the FLUSH# and SMI# pins are synchronous and the set up and hold times 
are met, then the FLUSH# and SMI# pins may be asserted in the same clock. In asynchronous systems, the 
FLUSH# pin must be asserted at least one clock before the SMI# pin to guarantee that the FLUSH# pin is serviced 
first. 


Upon leaving SMM (for systems that explicitly flush the caches), the WBINVD instruction should be executed prior 
to leaving SMM to flush the caches. 


NOTES 


In systems based on the Pentium processor that use the FLUSH# pin to write back and invalidate 
cache contents before entering SMM, the processor will prefetch at least one cache line in between 
when the Flush Acknowledge cycle is run and the subsequent recognition of SMI# and the assertion 
of SMIACT#. 

It is the obligation of the system to ensure that these lines are not cached by returning KEN# 
inactive to the Pentium processor. 


32.4.2.1 System Management Range Registers (SMRR) 


SMI handler code and data stored by SMM code resides in SMRAM. The SMRR interface is an enhancement in Intel 
64 architecture to limit cacheable reference of addresses in SMRAM to code running in SMM. The SMRR interface 
can be configured only by code running in SMM. Details of SMRR is described in Section 12.11.2.4. 


32.5 SMIHANDLER EXECUTION ENVIRONMENT 


Section 32.5.1 describes the initial execution environment for an SMI handler. An SMI handler may re-configure its 
execution environment to other supported operating modes. Section 32.5.2 discusses modifications an SMI 
handler can make to its execution environment. Section 32.5.3 discusses Control-flow Enforcement Technology 
(CET) interactions in the environment. 


32.5.1 Initial SMM Execution Environment 


After saving the current context of the processor, the processor initializes its core registers to the values shown in 
Table 32-4. Upon entering SMM, the PE and PG flags in control register CRO are cleared, which places the processor 
in an environment similar to real-address mode. The differences between the SMM execution environment and the 
real-address mode execution environment are as follows: 


¢ The addressable address space ranges from 0 to FFFFFFFFH (4 GBytes). 
¢ The normal 64-KByte segment limit for real-address mode is increased to 4 GBytes. 


° The default operand and address sizes are set to 16 bits, which restricts the addressable SMRAM address space 
to the 1-MByte real-address mode limit for native real-address-mode code. However, operand-size and 
address-size override prefixes can be used to access the address space beyond the 1-MByte. 


Table 32-4. Processor Register Initialization in SMM 


Register Contents 

General-purpose registers Undefined 

EFLAGS 00000002H 

EIP 00008000H 

CS selector SMM Base shifted right 4 bits (default 3000H) 
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Table 32-4. Processor Register Initialization in SMM 


CS base SMM Base (default 30000H) 

DS, ES, FS, GS, SS Selectors 0000H 

DS, ES, FS, GS, SS Bases 000000000H 

DS, ES, FS, GS, SS Limits OFFFFFFFFH 

CRO PE, EM, TS, and PG flags set to 0; others unmodified 
CR4 Cleared to zero 

DR6 Undefined 

DR7 00000400H 


¢ Near jumps and calls can be made to anywhere in the 4-GByte address space if a 32-bit operand-size override 
prefix is used. Due to the real-address-mode style of base-address formation, a far call or jump cannot transfer 
control to a segment with a base address of more than 20 bits (1 MByte). However, since the segment limit in 
SMM is 4 GBytes, offsets into a segment that go beyond the 1-MByte limit are allowed when using 32-bit 
operand-size override prefixes. Any program control transfer that does not have a 32-bit operand-size override 
prefix truncates the EIP value to the 16 low-order bits. 


* Data and the stack can be located anywhere in the 4-GByte address space, but can be accessed only with a 32- 
bit address-size override if they are located above 1 MByte. As with the code segment, the base address for a 
data or stack segment cannot be more than 20 bits. 


The value in segment register CS is automatically set to the default of 30000H for the SMBASE shifted 4 bits to the 
right; that is, 3000H. The EIP register is set to 8000H. When the EIP value is added to shifted CS value (the 
SMBASE), the resulting linear address points to the first instruction of the SMI handler. 


The other segment registers (DS, SS, ES, FS, and GS) are cleared to 0 and their segment limits are set to 4 GBytes. 
In this state, the SMRAM address space may be treated as a single flat 4-GByte linear address space. If a segment 
register is loaded with a 16-bit value, that value is then shifted left by 4 bits and loaded into the segment base 
(hidden part of the segment register). The limits and attributes are not modified. 


Maskable hardware interrupts, exceptions, NMI interrupts, SMI interrupts, A20M interrupts, single-step traps, 
breakpoint traps, and INIT operations are inhibited when the processor enters SMM. Maskable hardware interrupts, 
exceptions, single-step traps, and breakpoint traps can be enabled in SMM if the SMM execution environment 
provides and initializes an interrupt table and the necessary interrupt and exception handlers (see Section 32.6). 


32.5.2 SMI Handler Operating Mode Switching 


Within SMM, an SMI handler may change the processor's operating mode (e.g., to enable PAE paging, enter 64-bit 
mode, etc.) after it has made proper preparation and initialization to do so. For example, if switching to 32-bit 
protected mode, the SMI handler should follow the guidelines provided in Chapter 10, “Processor Management and 
Initialization.” If the SMI handler does wish to change operating mode, it is responsible for executing the appro- 
priate mode-transition code after each SMI. 


It is recommended that the SMI handler make use of all means available to protect the integrity of its critical code 
and data. In particular, it should use the system-management range register (SMRR) interface if it is available (see 
Section 11.11.2.4). The SMRR interface can protect only the first 4 GBytes of the physical address space. The SMI 
handler should take that fact into account if it uses operating modes that allow access to physical addresses beyond 
that 4-GByte limit (e.g., PAE paging or 64-bit mode). 


Execution of the RSM instruction restores the pre-SMI processor state from the SMRAM state-state map (see 
Section 32.4.1) into which it was stored when the processor entered SMM. (The SMBASE field in the SMRAM state- 
save map does not determine the state following RSM but rather the initial environment following the next entry to 
SMM.) Any required change to operating mode is performed by the RSM instruction; there is no need for the SMI 
handler to change modes explicitly prior to executing RSM. 
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32.5.3 Control-flow Enforcement Technology Interactions 


On processors that support CET shadow stacks, when the processor enters SMM, the processor saves the SSP 
register to the SMRAM state save area (see Table 32-3) and clears CR4.CET to O. Thus, the initial execution envi- 
ronment of the SMI handler has CET disabled and all of the CET state of the interrupted program is still in the 
machine. An SMM that uses CET is required to save the interrupted program’s CET state and restore the CET state 
prior to exiting SMM. 


32.6 EXCEPTIONS AND INTERRUPTS WITHIN SMM 


When the processor enters SMM, all hardware interrupts are disabled in the following manner: 


¢ The IF flag in the EFLAGS register is cleared, which inhibits maskable hardware interrupts from being 
generated. 


¢ The TF flag in the EFLAGS register is cleared, which disables single-step traps. 


° Debug register DR7 is cleared, which disables breakpoint traps. (This action prevents a debugger from acciden- 
tally breaking into an SMI handler if a debug breakpoint is set in normal address space that overlays code or 
data in SMRAM.) 


¢ NMI, SMI, and A20M interrupts are blocked by internal SMM logic. (See Section 32.8 for more information 
about how NMIs are handled in SMM.) 


Software-invoked interrupts and exceptions can still occur, and maskable hardware interrupts can be enabled by 
setting the IF flag. Intel recommends that SMM code be written in so that it does not invoke software interrupts 
(with the INT n, INTO, INT1, INT3, or BOUND instructions) or generate exceptions. 


If the SMI handler requires interrupt and exception handling, an SMM interrupt table and the necessary exception 
and interrupt handlers must be created and initialized from within SMM. Until the interrupt table is correctly initial- 
ized (using the LIDT instruction), exceptions and software interrupts will result in unpredictable processor 
behavior. 


The following restrictions apply when designing SMM interrupt and exception-handling facilities: 


° The interrupt table should be located at linear address 0 and must contain real-address mode style interrupt 
vectors (4 bytes containing CS and IP). 


* Due to the real-address mode style of base address formation, an interrupt or exception cannot transfer control 
to a segment with a base address of more that 20 bits. 


e An interrupt or exception cannot transfer control to a segment offset of more than 16 bits (64 KBytes). 


¢ When an exception or interrupt occurs, only the 16 least-significant bits of the return address (EIP) are pushed 
onto the stack. If the offset of the interrupted procedure is greater than 64 KBytes, it is not possible for the 
interrupt/exception handler to return control to that procedure. (One solution to this problem is for a handler 
to adjust the return address on the stack.) 


° The SMBASE relocation feature affects the way the processor will return from an interrupt or exception 
generated while the SMI handler is executing. For example, if the SMBASE is relocated to above 1 MByte, but 
the exception handlers are below 1 MByte, a normal return to the SMI handler is not possible. One solution is 
to provide the exception handler with a mechanism for calculating a return address above 1 MByte from the 16- 
bit return address on the stack, then use a 32-bit far call to return to the interrupted procedure. 


¢ If an SMI handler needs access to the debug trap facilities, it must ensure that an SMM accessible debug 
handler is available and save the current contents of debug registers DRO through DR3 (for later restoration). 
Debug registers DRO through DR3 and DR7 must then be initialized with the appropriate values. 


¢ If an SMI handler needs access to the single-step mechanism, it must ensure that an SMM accessible single- 
step handler is available, and then set the TF flag in the EFLAGS register. 


¢ If the SMI design requires the processor to respond to maskable hardware interrupts or software-generated 
interrupts while in SMM, it must ensure that SMM accessible interrupt handlers are available and then set the 
IF flag in the EFLAGS register (using the STI instruction). Software interrupts are not blocked upon entry to 
SMM, so they do not need to be enabled. 
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32.7. MANAGING SYNCHRONOUS AND ASYNCHRONOUS SYSTEM MANAGEMENT 
INTERRUPTS 


When coding for a multiprocessor system or a system with Intel HT Technology, it was not always possible for an 
SMI handler to distinguish between a synchronous SMI (triggered during an I/O instruction) and an asynchronous 
SMI. To facilitate the discrimination of these two events, incremental state information has been added to the SMM 


state save map. 
Processors that have an SMM revision ID of 30004H or higher have the incremental state information described 
below. 


32.7.1 1/0 State Implementation 


Within the extended SMM state save map, a bit (IO_SMI) is provided that is set only when an SMI is either taken 
immediately after a successful I/O instruction or is taken after a successful iteration of a REP I/O instruction (the 
successful notion pertains to the processor point of view; not necessarily to the corresponding platform function). 
When set, the IO_SMI bit provides a strong indication that the corresponding SMI was synchronous. In this case, 
the SMM State Save Map also supplies the port address of the I/O operation. The IO_SMI bit and the I/O Port 
Address may be used in conjunction with the information logged by the platform to confirm that the SMI was 
indeed synchronous. 

The IO_SMI bit by itself is a strong indication, not a guarantee, that the SMI is synchronous. This is because an 
asynchronous SMI might coincidentally be taken after an I/O instruction. In such a case, the IO_SMI bit would still 
be set in the SMM state save map. 


Information characterizing the I/O instruction is saved in two locations in the SMM State Save Map (Table 32-5). 
The IO_SMI bit also serves as a valid bit for the rest of the I/O information fields. The contents of these I/O infor- 
mation fields are not defined when the IO_SMI bit is not set. 


Table 32-5. 1/0 Instruction Information in the SMM State Save Map 


State (SMM Rev. ID: 30004H or higher) Format 
31 16 15 8 7 4 3 1 0 
I/O State Field S © S 5 So 
SMRAM offset 7FA4 g @ = > zg 
- a 3 a; * 
a 
31 0 
1/0 Memory Address Field 1/O Memory Address 
SMRAM offset 7FAO 
When IO_SM is set, the other fields may be interpreted as follows: 
¢ 1/0 length: 
¢ 001 - Byte 


¢ 010 - Word 
¢ 100 - Dword 
¢ J/O instruction type (Table 32-6) 


Table 32-6. 1/0 Instruction Type Encodings 


Instruction Encoding 
IN Immediate 1001 
IN DX 0001 
OUT Immediate 1000 
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Table 32-6. 1/0 Instruction Type Encodings (Contd.) 


Instruction Encoding 
OUT DX 0000 
INS 0011 
OUTS 0010 
REP INS 0111 
REP OUTS 0110 


32.8 NMIHANDLING WHILE IN SMM 


NMI interrupts are blocked upon entry to the SMI handler. If an NMI request occurs during the SMI handler, it is 
latched and serviced after the processor exits SMM. Only one NMI request will be latched during the SMI handler. 
If an NMI request is pending when the processor executes the RSM instruction, the NMI is serviced before the next 
instruction of the interrupted code sequence. This assumes that NMIs were not blocked before the SMI occurred. If 
NMIs were blocked before the SMI occurred, they are blocked after execution of RSM. 


Although NMI requests are blocked when the processor enters SMM, they may be enabled through software by 
executing an IRET instruction. If the SMI handler requires the use of NMI interrupts, it should invoke a dummy 
interrupt service routine for the purpose of executing an IRET instruction. Once an IRET instruction is executed, 
NMI interrupt requests are serviced in the same “real mode” manner in which they are handled outside of SMM. 


Also, for the Pentium processor, exceptions that invoke a trap or fault handler will enable NMI interrupts from inside 
of SMM. This behavior is implementation specific for the Pentium processor and is not part of the IA-32 architec- 
ture. 


32.9 SMM REVISION IDENTIFIER 


The SMM revision identifier field is used to indicate the version of SMM and the SMM extensions that are supported 
by the processor (see Figure 32-2). The SMM revision identifier is written during SMM entry and can be examined 
in SMRAM space at offset 7EFCH. The lower word of the SMM revision identifier refers to the version of the base 
SMM architecture. 


Register Offset 

7EFCH 

31 18171615 0 
Reserved SMM Revision Identifier 


SMBASE Relocation 
I/O Instruction Restart 


Figure 32-2. SMM Revision Identifier 


The upper word of the SMM revision identifier refers to the extensions available. If the I/O instruction restart flag 
(bit 16) is set, the processor supports the I/O instruction restart (see Section 32.12); if the SMBASE relocation flag 
(bit 17) is set, SMRAM base address relocation is supported (see Section 32.11). 
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32.10 AUTO HALT RESTART 


If the processor is in a HALT state (due to the prior execution of a HLT instruction) when it receives an SMI, the 
processor records the fact in the auto HALT restart flag in the saved processor state (see Figure 32-3). (This flag is 
located at offset 7FO2H and bit 0 in the state save area of the SMRAM.) 


If the processor sets the auto HALT restart flag upon entering SMM (indicating that the SMI occurred when the 
processor was in the HALT state), the SMI handler has two options: 


¢ It can leave the auto HALT restart flag set, which instructs the RSM instruction to return program control to the 
HLT instruction. This option in effect causes the processor to re-enter the HALT state after handling the SMI. 
(This is the default operation. ) 


¢ It can clear the auto HALT restart flag, which instructs the RSM instruction to return program control to the 
instruction following the HLT instruction. 


15 10 


Register Offset 
Reserved 7F02H 


Auto HALT Restart — 


Figure 32-3. Auto HALT Restart Field 


These options are summarized in Table 32-7. If the processor was not in a HALT state when the SMI was received 
(the auto HALT restart flag is cleared), setting the flag to 1 will cause unpredictable behavior when the RSM instruc- 
tion is executed. 


Table 32-7. Auto HALT Restart Flag Values 


Value of Flag After | Value of Flag When Action of Processor When Exiting SMM 

Entry to SMM Exiting SMM 

0 0) Returns to next instruction in interrupted program or task. 
0 1 Unpredictable. 

1 0 Returns to next instruction after HLT instruction. 

1 1 Returns to HALT state. 


If the HLT instruction is restarted, the processor will generate a memory access to fetch the HLT instruction (if it is 
not in the internal cache), and execute a HLT bus transaction. This behavior results in multiple HLT bus transactions 
for the same HLT instruction. 


32.10.1 Executing the HLT Instruction in SMM 


The HLT instruction should not be executed during SMM, unless interrupts have been enabled by setting the IF flag 
in the EFLAGS register. If the processor is halted in SMM, the only event that can remove the processor from this 
state is a maskable hardware interrupt or a hardware reset. 


32.11 SMBASE RELOCATION 


The default base address for the SMRAM is 30000H. This value is contained in an internal processor register called 
the SMBASE register. Software can relocate the SMRAM by setting the SMBASE field in the saved state map (at 

offset 7EF8H) to a new value (see Figure 32-4). The RSM instruction reloads the internal SMBASE register with the 
value in the SMBASE field each time it exits SMM. All subsequent SMI requests will use the new SMBASE value to 
find the starting address for the SMI handler (at SMBASE + 8000H) and the SMRAM state save area (from SMBASE 
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+ FEOOH to SMBASE + FFFFH). (The processor resets the value in its internal SMBASE register to 30000H ona 
RESET, but does not change it on an INIT.) 


31 0 


Register Offset 


SMM Base 7EF8H 


Figure 32-4. SMBASE Relocation Field 


In multiple-processor systems, initialization software must adjust the SMBASE value for each processor so that the 
SMRAM state save areas for each processor do not overlap. (For Pentium and Intel486 processors, the SMBASE 
values must be aligned on a 32-KByte boundary or the processor will enter shutdown state during the execution of 
a RSM instruction.) 


If the SMBASE relocation flag in the SMM revision identifier field is set, it indicates the ability to relocate the 
SMBASE (see Section 32.9). 


32.12 I/O INSTRUCTION RESTART 


If the I/O instruction restart flag in the SMM revision identifier field is set (see Section 32.9), the I/O instruction 
restart mechanism is present on the processor. This mechanism allows an interrupted I/O instruction to be re- 
executed upon returning from SMM mode. For example, if an I/O instruction is used to access a powered-down I/O 
device, a chipset supporting this device can intercept the access and respond by asserting SMI#. This action 
invokes the SMI handler to power-up the device. Upon returning from the SMI handler, the I/O instruction restart 
mechanism can be used to re-execute the I/O instruction that caused the SMI. 


The I/O instruction restart field (at offset 7FOOH in the SMM state-save area, see Figure 32-5) controls I/O instruc- 
tion restart. When an RSM instruction is executed, if this field contains the value FFH, then the EIP register is modi- 
fied to point to the I/O instruction that received the SMI request. The processor will then automatically re-execute 
the I/O instruction that the SMI trapped. (The processor saves the necessary machine state to ensure that re- 
execution of the instruction is handled coherently. ) 


15 0 


: : Register Offset 
I/O Instruction Restart Field 
/O Instruction Restart Fie 7FO0H 


Figure 32-5. I/O Instruction Restart Field 


If the I/O instruction restart field contains the value OOH when the RSM instruction is executed, then the processor 
begins program execution with the instruction following the I/O instruction. (When a repeat prefix is being used, 
the next instruction may be the next I/O instruction in the repeat loop.) Not re-executing the interrupted I/O 
instruction is the default behavior; the processor automatically initializes the I/O instruction restart field to OOH 
upon entering SMM. Table 32-8 summarizes the states of the I/O instruction restart field. 
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Table 32-8. I/O Instruction Restart Field Values 


Value of Flag After Value of Flag When Action of Processor When Exiting SMM 
Entry to SMM Exiting SMM 

OOH OOH Does not re-execute trapped I/O instruction. 
OOH FFH Re-executes trapped 1/0 instruction. 


The I/O instruction restart mechanism does not indicate the cause of the SMI. It is the responsibility of the SMI 
handler to examine the state of the processor to determine the cause of the SMI and to determine if an I/O instruc- 
tion was interrupted and should be restarted upon exiting SMM. If an SMI interrupt is signaled on a non-I/O instruc- 
tion boundary, setting the I/O instruction restart field to FFH prior to executing the RSM instruction will likely result 
in a program error. 


32.12.1 Back-to-Back SMI Interrupts When I/O Instruction Restart Is Being Used 


If an SMI interrupt is signaled while the processor is servicing an SMI interrupt that occurred on an I/O instruction 
boundary, the processor will service the new SMI request before restarting the originally interrupted I/O instruc- 
tion. If the I/O instruction restart field is set to FFH prior to returning from the second SMI handler, the EIP will point 
to an address different from the originally interrupted I/O instruction, which will likely lead to a program error. To 
avoid this situation, the SMI handler must be able to recognize the occurrence of back-to-back SMI interrupts when 
I/O instruction restart is being used and ensure that the handler sets the I/O instruction restart field to OOH prior 
to returning from the second invocation of the SMI handler. 


32.13 SMM MULTIPLE-PROCESSOR CONSIDERATIONS 


The following should be noted when designing multiple-processor systems: 
¢ Any processor in a multiprocessor system can respond to an SMI. 
¢ Each processor needs its own SMRAM space. This space can be in system memory or in a separate RAM. 


¢ The SMRAMs for different processors can be overlapped in the same memory space. The only stipulation is that 
each processor needs its own state save area and its own dynamic data storage area. (Also, for the Pentium 
and Intel486 processors, the SMBASE address must be located on a 32-KByte boundary.) Code and static data 
can be shared among processors. Overlapping SMRAM spaces can be done more efficiently with the P6 family 
processors because they do not require that the SMBASE address be on a 32-KByte boundary. 


¢ The SMI handler will need to initialize the SMBASE for each processor. 


* Processors can respond to local SMIs through their SMI# pins or to SMIs received through the APIC interface. 
The APIC interface can distribute SMIs to different processors. 


* Two or more processors can be executing in SMM at the same time. 


¢ When operating Pentium processors in dual processing (DP) mode, the SMIACT# pin is driven only by the MRM 
processor and should be sampled with ADS#. For additional details, see Chapter 14 of the Pentium Processor 
Family User’s Manual, Volume 1. 


SMM is not re-entrant, because the SMRAM State Save Map is fixed relative to the SMBASE. If there is a need to 
support two or more processors in SMM mode at the same time then each processor should have dedicated SMRAM 
spaces. This can be done by using the SMBASE Relocation feature (see Section 32.11). 


32.14 DEFAULT TREATMENT OF SMIS AND SMM WITH VMX OPERATION AND 
SMX OPERATION 


Under the default treatment, the interactions of SMIs and SMM with VMX operation are few. This section details 
those interactions. It also explains how this treatment affects SMX operation. 
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32.14.1 Default Treatment of SMI Delivery 


Ordinary SMI delivery saves processor state into SMRAM and then loads state based on architectural definitions. 
Under the default treatment, processors that support VMX operation perform SMI delivery as follows: 


enter SMM; 
save the following internal to the processor: 
CR4.VMXE 
an indication of whether the logical processor was in VMX operation (root or non-root) 
IF the logical processor is in VMX operation 
THEN 
save current VMCS pointer internal to the processor; 
leave VMX operation; 
save VMx-critical state defined below; 
Fl; 
IF the logical processor supports SMX operation 
THEN 
save internal to the logical processor an indication of whether the Intel® TXT private space is locked; 
IF the TXT private space is unlocked 
THEN lock the TXT private space; 
Fl; 
Fl; 
CR4.VMXE := 0; 
perform ordinary SMI delivery: 
save processor state in SMRAM; 
set processor state to standard SMM values;! 
invalidate linear mappings and combined mappings associated with VPID OOOOH (for all PCIDs); combined mappings for VPID OOOOH 
are invalidated for all EPTRTA values (EPTRTA is the value of bits 51:12 of EPTP; see Section 29.4); 


The pseudocode above makes reference to the saving of VMX-critical state. This state consists of the following: 
(1) SS.DPL (the current privilege level); (2) RFLAGS.VM2; (3) the state of blocking by STI and by MOV SS (see 
Table 25-3 in Section 25.4.2); (4) the state of virtual-NMI blocking (only if the processor is in VMX non-root oper- 
ation and the “virtual NMIs” VM-execution control is 1); and (5) an indication of whether an MTF VM exit is pending 
(see Section 26.5.2). These data may be saved internal to the processor or in the VMCS region of the current 
VMCS. Processors that do not support SMI recognition while there is blocking by STI or by MOV SS need not save 
the state of such blocking. 


If the logical processor supports the 1-setting of the “enable EPT” VM-execution control and the logical processor 
was in VMX non-root operation at the time of an SMI, it saves the value of that control into bit 0 of the 32-bit field 
at offset SMBASE + 8000H + 7EEOH (SMBASE + FEEOH; see Table 32-3).? If the logical processor was not in VMX 
non-root operation at the time of the SMI, it saves 0 into that bit. If the logical processor saves 1 into that bit (it 
was in VMX non-root operation and the “enable EPT” VM-execution control was 1), it saves the value of the EPT 
pointer (EPTP) into the 64-bit field at offset SMBASE + 8000H + 7ED8H (SMBASE + FED8H). 


Because SMI delivery causes a logical processor to leave VMX operation, all the controls associated with VMX non- 
root operation are disabled in SMM and thus cannot cause VM exits while the logical processor in SMM. 


1. This causes the logical processor to block INIT signals, NMIs, and SMIs. 


2. Section 32.14 and Section 32.15 use the notation RAX, RIP, RSP, RFLAGS, etc. for processor registers because most processors that 
support VMX operation also support Intel 64 architecture. For processors that do not support Intel 64 architecture, this notation 
refers to the 32-bit forms of these registers (EAX, EIP, ESP, EFLAGS, etc.). In a few places, notation such as EAX is used to refer spe- 
cifically to the lower 32 bits of the register. 


3. “Enable EPT” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution controls 
is O, SMI functions as the “enable EPT” VM-execution control were 0. See Section 25.6.2. 
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32.14.2 Default Treatment of RSM 


Ordinary execution of RSM restores processor state from SMRAM. Under the default treatment, processors that 
support VMX operation perform RSM as follows: 


IF VMXE = 1 in CR4 image in SMRAM 
THEN fail and enter shutdown state; 
ELSE 
restore state normally from SMRAM; 
invalidate linear mappings and combined mappings associated with all VPIDs and all PCIDs; combined mappings are invalidated 
for all EPTRTA values (EPTRTA is the value of bits 51:12 of EPTP; see Section 29.4); 
IF the logical processor supports SMX operation andthe Intel® TXT private space was unlocked at the time of the last SMI (as 


saved) 
THEN unlock the TXT private space; 
Fl; 
CR4.VMXE := value stored internally; 
IF internal storage indicates that the logical processor 
had been in VMX operation (root or non-root) 
THEN 
enter VMX operation (root or non-root); 
restore VMX-critical state as defined in Section 32.14.1; 
set to their fixed values any bits in CRO and CR4 whose values must be fixed in VMX operation (see Section 24.8);! 
IF RFLAGS.VM = 0 AND (in VMX root operation OR the “unrestricted guest” VM-execution control is 0)2 
THEN 
CS.RPL := SS.DPL; 
SS.RPL := SS.DPL; 
Fl; 
restore current VMCS pointer; 
Fl; 
leave SMM; 
IF logical processor will be in VMX operation or in SMX operation after RSM 
THEN block AZ0M and leave A20M mode; 
Fl; 
Fl; 


RSM unblocks SMIs. It restores the state of blocking by NMI (see Table 25-3 in Section 25.4.2) as follows: 


¢ If the RSM is not to VMX non-root operation or if the “virtual NMIs” VM-execution control will be 0, the state of 
NMI blocking is restored normally. 


° If the RSM is to VMX non-root operation and the “virtual NMIs” VM-execution control will be 1, NMIs are not 
blocked after RSM. The state of virtual-NMI blocking is restored as part of VMX-critical state. 


INIT signals are blocked after RSM if and only if the logical processor will be in VMX root operation. 


If RSM returns a logical processor to VMX non-root operation, it re-establishes the controls associated with the 
current VMCS. If the “interrupt-window exiting” VM-execution control is 1, a VM exit occurs immediately after RSM 
if the enabling conditions apply. The same is true for the “NMI-window exiting” VM-execution control. Such 

VM exits occur with their normal priority. See Section 26.2. 


If an MTF VM exit was pending at the time of the previous SMI, an MTF VM exit is pending on the instruction 
boundary following execution of RSM. The following items detail the treatment of MTF VM exits that may be 
pending following RSM: 


1. If the RSM is to VMX non-root operation and both the “unrestricted quest” VM-execution control and bit 31 of the primary proces- 
sor-based VM-execution controls will be 1, CRO.PE and CRO.PG retain the values that were loaded from SMRAM regardless of what is 
reported in the capability MSR [A32_WMX_CRO_FIXEDO. 

2. “Unrestricted quest” is a secondary processor-based VM-execution control. If bit 31 of the primary processor-based VM-execution 
controls is 0, VM entry functions as if the “unrestricted quest” VM-execution control were 0. See Section 25.6.2. 
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¢ System-management interrupts (SMIs), INIT signals, and higher priority events take priority over these MTF 
VM exits. These MTF VM exits take priority over debug-trap exceptions and lower priority events. 


° These MTF VM exits wake the logical processor if RSM caused the logical processor to enter the HLT state (see 
Section 32.10). They do not occur if the logical processor just entered the shutdown state. 


32.14.3 Protection of CR4.VMXE in SMM 


Under the default treatment, CR4.VMXE is treated as a reserved bit while a logical processor is in SMM. Any 
attempt by software running in SMM to set this bit causes a general-protection exception. In addition, software 
cannot use VMX instructions or enter VMX operation while in SMM. 


32.14.4 VWMXOFF and SMI Unblocking 


The VMXOFF instruction can be executed only with the default treatment (see Section 32.15.1) and only outside 
SMM. If SMIs are blocked when VMXOFF is executed, VMXOFF unblocks them unless 
IA32_SMM_MONITOR_CTLI[bit 2] is 1 (see Section 32.15.5 for details regarding this MSR).! Section 32.15.7 iden- 
tifies a case in which SMIs may be blocked when VMXOFF is executed. 


Not all processors allow this bit to be set to 1. Software should consult the VMX capability MSR IA32_VMX_MISC 
(see Appendix A.6) to determine whether this is allowed. 


32.15 DUAL-MONITOR TREATMENT OF SMIs AND SMM 


Dual-monitor treatment is activated through the cooperation of the executive monitor (the VMM that operates 
outside of SMM to provide basic virtualization) and the SMM-transfer monitor (STM; the VMM that operates 
inside SMM—while in VMX operation—to support system-management functions). Control is transferred to the STM 
through VM exits; VM entries are used to return from SMM. 


The dual-monitor treatment may not be supported by all processors. Software should consult the VMX capability 
MSR IA32_VMX_BASIC (see Appendix A.1) to determine whether it is supported. 


32.15.1 Dual-Monitor Treatment Overview 


The dual-monitor treatment uses an executive monitor and an SMM-transfer monitor (STM). Transitions from the 
executive monitor or its guests to the STM are called SMM VM exits and are discussed in Section 32.15.2. SMM 
VM exits are caused by SMIs as well as executions of VMCALL in VMX root operation. The latter allow the executive 
monitor to call the STM for service. 


The STM runs in VMX root operation and uses VMX instructions to establish a VMCS and perform VM entries to its 
own guests. This is done all inside SMM (see Section 32.15.3). The STM returns from SMM, not by using the RSM 
instruction, but by using a VM entry that returns from SMM. Such VM entries are described in Section 32.15.4. 


Initially, there is no STM and the default treatment (Section 32.14) is used. The dual-monitor treatment is not used 
until it is enabled and activated. The steps to do this are described in Section 32.15.5 and Section 32.15.6. 


It is not possible to leave VMX operation under the dual-monitor treatment; VMXOFF will fail if executed. The dual- 
monitor treatment must be deactivated first. The STM deactivates dual-monitor treatment using a VM entry that 
returns from SMM with the “deactivate dual-monitor treatment” VM-entry control set to 1 (see Section 32.15.7). 


The executive monitor configures any VMCS that it uses for VM exits to the executive monitor. SMM VM exits, which 
transfer control to the STM, use a different VMCS. Under the dual-monitor treatment, each logical processor uses 
a separate VMCS called the SMM-transfer VMCS. When the dual-monitor treatment is active, the logical 
processor maintains another VMCS pointer called the SMM-transfer VMCS pointer. The SMM-transfer VMCS 
pointer is established when the dual-monitor treatment is activated. 


1. Setting IA32_SMM_MONITOR_CTLI[bit 2] to 1 prevents VMXOFF from unblocking SMls regardless of the value of the register’s valid 
bit (bit 0). 
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32.15.2 SMM VM Exits 
An SMM VM exit is a VM exit that begins outside SMM and that ends in SMM. 


Unlike other VM exits, SMM VM exits can begin in VMX root operation. SMM VM exits result from the arrival of an 
SMI outside SMM or from execution of VMCALL in VMX root operation outside SMM. Execution of VMCALL in VMX 
root operation causes an SMM VM exit only if the valid bit is set in the IA32_SMM_MONITOR_CTL MSR (see Section 
32.15.5). 


Execution of VMCALL in VMX root operation causes an SMM VM exit even under the default treatment. This SMM 
VM exit activates the dual-monitor treatment (see Section 32.15.6). 


Differences between SMM VM exits and other VM exits are detailed in Sections 32.15.2.1 through 32.15.2.5. 
Differences between SMM VM exits that activate the dual-monitor treatment and other SMM VM exits are described 
in Section 32.15.6. 


32.15.2.1 Architectural State Before a VM Exit 


System-management interrupts (SMIs) that cause SMM VM exits always do so directly. They do not save state to 
SMRAM as they do under the default treatment. 


32.15.2.2 Updating the Current-VMCS and Executive-VMCS Pointers 

SMM VM exits begin by performing the following steps: 

1. The executive-VMCS pointer field in the SMM-transfer VMCS is loaded as follows: 
— Ifthe SMM VM exit commenced in VMX non-root operation, it receives the current-VMCS pointer. 
— Ifthe SMM VM exit commenced in VMX root operation, it receives the VMXON pointer. 

2. The current-VMCS pointer is loaded with the value of the SMM-transfer VMCS pointer. 


The last step ensures that the current VMCS is the SMM-transfer VMCS. VM-exit information is recorded in that 
VMCS, and VM-entry control fields in that VMCS are updated. State is saved into the guest-state area of that VMCS. 
The VM-exit controls and host-state area of that VMCS determine how the VM exit operates. 


32.15.2.3 Recording VM-Exit Information 


SMM VM exits differ from other VM exit with regard to the way they record VM-exit information. The differences 
follow. 


e Exit reason. 


— Bits 15:0 of this field contain the basic exit reason. The field is loaded with the reason for the SMM VM exit: 
I/O SMI (an SMI arrived immediately after retirement of an I/O instruction), other SMI, or VMCALL. See 
Appendix C, “VMX Basic Exit Reasons.” 


— SMM VM exits are the only VM exits that may occur in VMX root operation. Because the SMM-transfer 
monitor may need to know whether it was invoked from VMX root or VMX non-root operation, this 
information is stored in bit 29 of the exit-reason field (see Table 25-18 in Section 25.9.1). The bit is set by 
SMM VM exits from VMX root operation. 


— Ifthe SMM VM exit occurred in VMX non-root operation and an MTF VM exit was pending, bit 28 of the exit- 
reason field is set; otherwise, it is cleared. 


— Bits 27:16 and bits 31:30 are cleared. 


° Exit qualification. For an SMM VM exit due an SMI that arrives immediately after the retirement of an I/O 
instruction, the exit qualification contains information about the I/O instruction that retired immediately before 
the SMI. It has the format given in Table 32-9. 


* Guest linear address. This field is used for VM exits due to SMIs that arrive immediately after the retirement 
of an INS or OUTS instruction for which the relevant segment (ES for INS; DS for OUTS unless overridden by 
an instruction prefix) is usable. The field receives the value of the linear address generated by ES:(E)DI (for 
INS) or segment:(E)SI (for OUTS; the default segment is DS but can be overridden by a segment override 
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Table 32-9. Exit Qualification for SMIls That Arrive Immediately After the Retirement of an I/O Instruction 


Bit Position(s) Contents 

2:0 Size of access: 
0 = 1-byte 
1 = 2-byte 
3 = 4-byte 


Other values not used. 


3 Direction of the attempted access (O = OUT, 1 = IN) 

4 String instruction (O = not string; 1 = string) 

5 REP prefixed (O = not REP; 1 = REP) 

6 Operand encoding (0 = DX, 1 = immediate) 

15:7 Reserved (cleared to 0) 

31:16 Port number (as specified in the I/O instruction) 

63:32 Reserved (cleared to 0). These bits exist only on processors 


that support Intel 64 architecture. 


prefix) at the time the instruction started. If the relevant segment is not usable, the value is undefined. On 
processors that support Intel 64 architecture, bits 63:32 are clear if the logical processor was not in 64-bit 
mode before the VM exit. 


¢ 1/0 RCX, I/O RSI, I/O RDI, and I/O RIP. For an SMM VM exit due an SMI that arrives immediately after 
the retirement of an I/O instruction, these fields receive the values that were in RCX, RSI, RDI, and RIP, respec- 
tively, before the I/O instruction executed. Thus, the value saved for I/O RIP addresses the I/O instruction. 


32.15.2.4 Saving Guest State 
SMM VM exits save the contents of the SMBASE register into the corresponding field in the guest-state area. 


The value of the VMX-preemption timer is saved into the corresponding field in the guest-state area if the “save 
VMX-preemption timer value” VM-exit control is 1. That field becomes undefined if, in addition, either the SMM 
VM exit is from VMX root operation or the SMM VM exit is from VMX non-root operation and the “activate VMX- 
preemption timer” VM-execution control is 0. 


32.15.2.5 Updating State 


If an SMM VM exit is from VMX non-root operation and the “Intel PT uses guest physical addresses” VM-execution 
control is 1, the IA32_RTIT_CTL MSR is cleared to 00000000_00000000H.! This is done even if the “clear IA32_R- 
TIT_CTL” VM-exit control is 0. 


SMM VM exits affect the non-register state of a logical processor as follows: 


° SMM VM exits cause non-maskable interrupts (NMIs) to be blocked; they may be unblocked through execution 
of IRET or through a VM entry (depending on the value loaded for the interruptibility state and the setting of 
the “virtual NMIs” VM-execution control). 


¢ SMM VM exits cause SMIs to be blocked; they may be unblocked by a VM entry that returns from SMM (see 
Section 32.15.4). 


1. In this situation, the value of this MSR was saved earlier into the quest-state area. All VM exits save this MSR if the 1-setting of the 
“load IA32_RTIT_CTL’” VM-entry control is supported (see Section 28.3.1), which must be the case if the “Intel PT uses guest physi- 
cal addresses” VM-execution control is 1 (see Section 27.2.1.1). 
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SMM VM exits invalidate linear mappings and combined mappings associated with VPID OOOOH for all PCIDs. 
Combined mappings for VPID OOOOH are invalidated for all EPTRTA values (EPTRTA is the value of bits 51:12 of 
EPTP; see Section 29.4). (Ordinary VM exits are not required to perform such invalidation if the “enable VPID” VM- 
execution control is 1; see Section 28.5.5.) 


32.15.3 Operation of the SMM-Transfer Monitor 


Once invoked, the SMM-transfer monitor (STM) is in VMX root operation and can use VMX instructions to configure 
VMCSs and to cause VM entries to virtual machines supported by those structures. As noted in Section 32.15.1, the 
VMXOFF instruction cannot be used under the dual-monitor treatment and thus cannot be used by the STM. 


The RSM instruction also cannot be used under the dual-monitor treatment. As noted in Section 26.1.3, it causes a 
VM exit if executed in SMM in VMX non-root operation. If executed in VMX root operation, it causes an invalid- 
opcode exception. The STM uses VM entries to return from SMM (see Section 32.15.4). 


32.15.4 VM Entries that Return from SMM 


The SMM-transfer monitor (STM) returns from SMM using a VM entry with the “entry to SMM” VM-entry control 
clear. VM entries that return from SMM reverse the effects of an SMM VM exit (see Section 32.15.2). 


VM entries that return from SMM may differ from other VM entries in that they do not necessarily enter VMX non- 
root operation. If the executive-VMCS pointer field in the current VMCS contains the VMXON pointer, the logical 
processor remains in VMX root operation after VM entry. 


For differences between VM entries that return from SMM and other VM entries see Sections 32.15.4.1 through 
32.15.4.10. 


32.15.4.1 Checks on the Executive-VMCS Pointer Field 


VM entries that return from SMM perform the following checks on the executive-VMCS pointer field in the current 
VMCS: 


¢ Bits 11:0 must be O. 
* The pointer must not set any bits beyond the processor’s physical-address width. !2 


¢ The 32 bits located in memory referenced by the physical address in the pointer must contain the processor's 
VMCS revision identifier (see Section 25.2). 


The checks above are performed before the checks described in Section 32.15.4.2 and before any of the following 
checks: 


¢ ‘If the “deactivate dual-monitor treatment” VM-entry control is 0 and the executive-VMCS pointer field does not 
contain the VMXON pointer, the launch state of the executive VMCS (the VMCS referenced by the executive- 
VMCS pointer field) must be launched (see Section 25.11.3). 


° If the “deactivate dual-monitor treatment” VM-entry control is 1, the executive-VMCS pointer field must 
contain the VMXON pointer (see Section 32.15.7).3 


32.15.4.2 Checks on VM-Execution Control Fields 


VM entries that return from SMM differ from other VM entries with regard to the checks performed on the VM- 
execution control fields specified in Section 27.2.1.1. They do not apply the checks to the current VMCS. Instead, 
VM-entry behavior depends on whether the executive-VMCS pointer field contains the VMXON pointer: 


1. Software can determine a processor's physical-address width by executing CPUID with BOO00008H in EAX. The physical-address 
width is returned in bits 7:0 of EAX. 


2. If 1A32_VMX_BASIC[48] is read as 1, this pointer must not set any bits in the range 63:32; see Appendix A.1. 


3. The STM can determine the VMXON pointer by reading the executive-VMCS pointer field in the current VMCS after the SMM VM exit 
that activates the dual-monitor treatment. 
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¢ = If the executive-VMCS pointer field contains the VMXON pointer (the VM entry remains in VMX root operation), 
the checks are not performed at all. 


e If the executive-VMCS pointer field does not contain the VMXON pointer (the VM entry enters VMX non-root 
operation), the checks are performed on the VM-execution control fields in the executive VMCS (the VMCS 
referenced by the executive-VMCS pointer field in the current VMCS). These checks are performed after 
checking the executive-VMCS pointer field itself (for proper alignment). 


Other VM entries ensure that, if “activate VMX-preemption timer” VM-execution control is 0, the “save VMX- 
preemption timer value” VM-exit control is also 0. This check is not performed by VM entries that return from SMM. 


32.15.4.3 Checks on VM-Entry Control Fields 


VM entries that return from SMM differ from other VM entries with regard to the checks performed on the VM-entry 
control fields specified in Section 27.2.1.3. 


Specifically, if the executive-VMCS pointer field contains the VMXON pointer (the VM entry remains in VMX root 
operation), the VM-entry interruption-information field must not indicate injection of a pending MTF VM exit (see 
Section 27.6.2). Specifically, the following cannot all be true for that field: 


° the valid bit (bit 31) is 1 
¢ the interruption type (bits 10:8) is 7 (other event); and 
¢ the vector (bits 7:0) is 0 (pending MTF VM exit). 


32.15.4.4 Checks on the Guest State Area 


Section 27.3.1 specifies checks performed on fields in the guest-state area of the VMCS. Some of these checks are 
conditioned on the settings of certain VM-execution controls (e.g., “virtual NMIs” or “unrestricted guest”). 

VM entries that return from SMM modify these checks based on whether the executive-VMCS pointer field contains 
the VMXON pointer:! 


¢ If the executive-VMCS pointer field contains the VMXON pointer (the VM entry remains in VMX root operation), 
the checks are performed as all relevant VM-execution controls were 0. (As a result, some checks may not be 
performed at all.) 


e If the executive-VMCS pointer field does not contain the VMXON pointer (the VM entry enters VMX non-root 
operation), this check is performed based on the settings of the VM-execution controls in the executive VMCS 
(the VMCS referenced by the executive-VMCS pointer field in the current VMCS). 


For VM entries that return from SMM, the activity-state field must not indicate the wait-for-SIPI state if the execu- 
tive-VMCS pointer field contains the VMXON pointer (the VM entry is to VMX root operation). 


32.15.4.5 Loading Guest State 
VM entries that return from SMM load the SMBASE register from the SMBASE field. 


VM entries that return from SMM invalidate linear mappings and combined mappings associated with all VPIDs. 
Combined mappings are invalidated for all EPTRTA values (EPTRTA is the value of bits 51:12 of EPTP; see Section 
29.4). (Ordinary VM entries are required to perform such invalidation only for VPID OOOOH and are not required to 
do even that if the “enable VPID” VM-execution control is 1; see Section 27.3.2.5.) 


32.15.4.6 VMX-Preemption Timer 


A VM entry that returns from SMM activates the VMX-preemption timer only if the executive-VMCS pointer field 
does not contain the VMXON pointer (the VM entry enters VMX non-root operation) and the “activate VMX-preemp- 
tion timer” VM-execution control is 1 in the executive VMCS (the VMCS referenced by the executive-VMCS pointer 
field). In this case, VM entry starts the VMX-preemption timer with the value in the VMX-preemption timer-value 
field in the current VMCS. 


1. The STM can determine the VMXON pointer by reading the executive-VMCS pointer field in the current VMCS after the SMM VM exit 
that activates the dual-monitor treatment. 
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32.15.4.7 Updating the Current-VMCS and SMM-Transfer VMCS Pointers 


Successful VM entries (returning from SMM) load the SMM-transfer VMCS pointer with the current-VMCS pointer. 
Following this, they load the current-VMCS pointer from a field in the current VMCS: 


¢ If the executive-VMCS pointer field contains the VMXON pointer (the VM entry remains in VMX root operation), 
the current-VMCS pointer is loaded from the VMCS-link pointer field. 


° If the executive-VMCS pointer field does not contain the VMXON pointer (the VM entry enters VMX non-root 
operation), the current-VMCS pointer is loaded with the value of the executive-VMCS pointer field. 


If the VM entry successfully enters VMX non-root operation, the VM-execution controls in effect after the VM entry 
are those from the new current VMCS. This includes any structures external to the VMCS referenced by VM-execu- 
tion control fields. 


The updating of these VMCS pointers occurs before event injection. Event injection is determined, however, by the 
VM-entry control fields in the VMCS that was current when the VM entry commenced. 


32.15.4.8 VM Exits Induced by VM Entry 


Section 27.6.1.2 describes how the event-delivery process invoked by event injection may lead to a VM exit. 
Section 27.7.3 to Section 27.7.7 describe other situations that may cause a VM exit to occur immediately after a 
VM entry. 


Whether these VM exits occur is determined by the VM-execution control fields in the current VMCS. For VM entries 
that return from SMM, they can occur only if the executive-VMCS pointer field does not contain the VMXON pointer 
(the VM entry enters VMX non-root operation). 


In this case, determination is based on the VM-execution control fields in the VMCS that is current after the 

VM entry. This is the VMCS referenced by the value of the executive-VMCS pointer field at the time of the VM entry 
(see Section 32.15.4.7). This VMCS also controls the delivery of such VM exits. Thus, VM exits induced by a 

VM entry returning from SMM are to the executive monitor and not to the STM. 


32.15.4.9 SMI Blocking 


VM entries that return from SMM determine the blocking of system-management interrupts (SMIs) as follows: 


¢ If the “deactivate dual-monitor treatment” VM-entry control is 0, SMIs are blocked after VM entry if and only if 
the bit 2 in the interruptibility-state field is 1. 


e If the “deactivate dual-monitor treatment” VM-entry control is 1, the blocking of SMIs depends on whether the 
logical processor is in SMX operation:! 


— Ifthe logical processor is in SMX operation, SMIs are blocked after VM entry. 
— Ifthe logical processor is outside SMX operation, SMIs are unblocked after VM entry. 


VM entries that return from SMM and that do not deactivate the dual-monitor treatment may leave SMIs blocked. 
This feature exists to allow the STM to invoke functionality outside of SMM without unblocking SMIs. 


32.15.4.10 Failures of VM Entries That Return from SMM 


Section 27.8 describes the treatment of VM entries that fail during or after loading guest state. Such failures record 
information in the VM-exit information fields and load processor state as would be done on a VM exit. The VMCS 
used is the one that was current before the VM entry commenced. Control is thus transferred to the STM and the 
logical processor remains in SMM. 


1. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi- 
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last 
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference,” in the Intel® 64 and IA-32 Architectures Soft- 
ware Developer's Manual, Volume 2D. 
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32.15.5 Enabling the Dual-Monitor Treatment 


Code and data for the SMM-transfer monitor (STM) reside in a region of SMRAM called the monitor segment 
(MSEG). Code running in SMM determines the location of MSEG and establishes its content. This code is also 
responsible for enabling the dual-monitor treatment. 


SMM code enables the dual-monitor treatment and specifies the location of MSEG by writing to the 
IA32_SMM_MONITOR_CTL MSR (index 9BH). The MSR has the following format: 


Bit 0 is the register’s valid bit. The STM may be invoked using VMCALL only if this bit is 1. Because VMCALL is 
used to activate the dual-monitor treatment (see Section 32.15.6), the dual-monitor treatment cannot be 
activated if the bit is 0. This bit is cleared when the logical processor is reset. 


Bit 1 is reserved. 


Bit 2 determines whether executions of VMXOFF unblock SMIs under the default treatment of SMIs and SMM. 
Executions of VMXOFF unblock SMIs unless bit 2 is 1 (the value of bit 0 is irrelevant). See Section 32.14.4. 


Certain leaf functions of the GETSEC instruction clear this bit (see Chapter 7, “Safer Mode Extensions 
Reference,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2D). 


Bits 11:3 are reserved. 


Bits 31:12 contain a value that, when shifted left 12 bits, is the physical address of MSEG (the MSEG base 
address). 


Bits 63:32 are reserved. 


The following items detail use of this MSR: 


The IA32_SMM_MONITOR_CTL MSR is supported only on processors that support the dual-monitor treatment.! 
On other processors, accesses to the MSR using RDMSR or WRMSR generate a general-protection fault 
(#GP(0)). 

A write to the IA32_SMM_MONITOR_CTL MSR using WRMSR generates a general-protection fault (#GP(0)) if 
executed outside of SMM or if an attempt is made to set any reserved bit. An attempt to write to the 
IA32_SMM_MONITOR_CTL MSR fails if made as part of a VM exit that does not end in SMM or part of a 

VM entry that does not begin in SMM. 


Reads from the IA32_SMM_MONITOR_CTL MSR using RDMSR are allowed any time RDMSR is allowed. The 
MSR may be read as part of any VM exit. 


The dual-monitor treatment can be activated only if the valid bit in the MSR is set to 1. 


The 32 bytes located at the MSEG base address are called the MSEG header. The format of the MSEG header is 
given in Table 32-10 (each field is 32 bits). 


Table 32-10. Format of MSEG Header 


Byte Offset Field 

0 MSEG-header revision identifier 
4 SMM-transfer monitor features 
8 GDTR limit 

12 GDTR base offset 

16 CS selector 

20 EIP offset 

24 ESP offset 

28 CR3 offset 


1. 


Software should consult the VMX capability MSR I[A32_VMX_BASIC (see Appendix A.1) to determine whether the dual-monitor 
treatment is supported. 
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To ensure proper behavior in VMX operation, software should maintain the MSEG header in writeback cacheable 
memory. Future implementations may allow or require a different memory type.! Software should consult the VMX 
capability MSR IA32_VMX_BASIC (see Appendix A.1). 


SMM code should enable the dual-monitor treatment (by setting the valid bit in IA32_SMM_MONITOR_CTL MSR) 
only after establishing the content of the MSEG header as follows: 


¢ Bytes 3:0 contain the MSEG revision identifier. Different processors may use different MSEG revision identi- 
fiers. These identifiers enable software to avoid using an MSEG header formatted for one processor ona 
processor that uses a different format. Software can discover the MSEG revision identifier that a processor uses 
by reading the VMX capability MSR IA32_VMX_MISC (see Appendix A.6). 


° Bytes 7:4 contain the SMM-transfer monitor features field. Bits 31:1 of this field are reserved and must be 
zero. Bit O of the field is the IA-32e mode SMM feature bit. It indicates whether the logical processor will be 
in IA-32e mode after the STM is activated (see Section 32.15.6). 


¢ Bytes 31:8 contain fields that determine how processor state is loaded when the STM is activated (see Section 
32.15.6.5). SMM code should establish these fields so that activating of the STM invokes the STM’s initialization 
code. 


32.15.6 Activating the Dual-Monitor Treatment 


The dual-monitor treatment may be enabled by SMM code as described in Section 32.15.5. The dual-monitor treat- 
ment is activated only if it is enabled and only by the executive monitor. The executive monitor activates the dual- 
monitor treatment by executing VMCALL in VMX root operation. 


When VMCALL activates the dual-monitor treatment, it causes an SMM VM exit. Differences between this SMM 
VM exit and other SMM VM exits are discussed in Sections 32.15.6.1 through 32.15.6.6. See also “VMCALL—Call to 
VM Monitor” in Chapter 31. 


32.15.6.1 Initial Checks 


An execution of VMCALL attempts to activate the dual-monitor treatment if (1) the processor supports the dual- 
monitor treatment; (2) the logical processor is in VMX root operation; (3) the logical processor is outside SMM and 
the valid bit is set in the IA32_SMM_MONITOR_CTL MSR; (4) the logical processor is not in virtual-8086 mode and 
not in compatibility mode; (5) CPL = 0; and (6) the dual-monitor treatment is not active. 


Such an execution of VMCALL begins with some initial checks. These checks are performed before updating the 
current-VMCS pointer and the executive-VMCS pointer field (see Section 32.15.2.2). 


The VMCS that manages SMM VM exit caused by this VMCALL is the current VMCS established by the executive 
monitor. The VMCALL performs the following checks on the current VMCS in the order indicated: 


1. There must be a current VMCS pointer. 
2. The launch state of the current VMCS must be clear. 
3. The VM-exit controls in the current VMCS must be set properly: 


¢ Reserved bits in the primary VM-exit controls must be set properly. Software may consult the VMX 
capability MSRs to determine the proper setting (see Appendix A.4.1). 


¢ Ifthe “activate secondary controls” primary VM-exit control is 1, reserved bits in the secondary VM-exit 
controls must be cleared. Software may consult the VMX capability MSRs to determine which bits are 
reserved (see Appendix A.4.2). 


1. Alternatively, software may map the MSEG header with the UC memory type; this may be necessary, depending on how memory is 
organized. Doing so is strongly discouraged unless necessary as it will cause the performance of transitions using those structures 
to suffer significantly. In addition, the processor will continue to use the memory type reported in the VMX capability MSR 
IA32_VMX_BASIC with exceptions noted in Appendix A.1. 

2. Software should consult the VMX capability MSR IA32_VMX_BASIC (see Appendix A.1) to determine whether the dual-monitor 
treatment is supported. 
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¢ Ifthe “activate secondary controls” primary VM-exit control is O (or if the processor does not support 
the 1-setting of that control), no checks are performed on the secondary VM-exit controls. The logical 
processor operates as if all the secondary VM-exit controls were 0. 


If any of these checks fail, subsequent checks are skipped and VMCALL fails. If all these checks succeed, the logical 
processor uses the IA32_SMM_MONITOR_CTL MSR to determine the base address of MSEG. The following checks 
are performed in the order indicated: 


1. The logical processor reads the 32 bits at the base of MSEG and compares them to the processor’s MSEG 
revision identifier. 


2. The logical processor reads the SMM-transfer monitor features field: 


— Bit 0 of the field is the IA-32e mode SMM feature bit, and it indicates whether the logical processor will be 
in IA-32e mode after the SMM-transfer monitor (STM) is activated. 


¢ If the VMCALL is executed on a processor that does not support Intel 64 architecture, the IA-32e mode 
SMM feature bit must be 0. 


¢ If the VMCALL is executed in 64-bit mode, the IA-32e mode SMM feature bit must be 1. 
— Bits 31:1 of this field are currently reserved and must be zero. 
If any of these checks fail, subsequent checks are skipped and the VMCALL fails. 


32.15.6.2 Updating the Current-VMCS and Executive-VMCS Pointers 


Before performing the steps in Section 32.15.2.2, SMM VM exits that activate the dual-monitor treatment begin by 
loading the SMM-transfer VMCS pointer with the value of the current-VMCS pointer. 


32.15.6.3 Saving Guest State 


As noted in Section 32.15.2.4, SMM VM exits save the contents of the SMBASE register into the corresponding field 
in the guest-state area. While this is true also for SMM VM exits that activate the dual-monitor treatment, the 
VMCS used for those VM exits exists outside SMRAM. 


The SMM-transfer monitor (STM) can also discover the current value of the SMBASE register by using the RDMSR 
instruction to read the IA32_SMBASE MSR (MSR address 9EH). The following items detail use of this MSR: 


¢ The MSR is supported only if IA32_VMX_MISC[15] = 1 (see Appendix A.6). 


¢ Awrite to the IA32_SMBASE MSR using WRMSR generates a general-protection fault (#GP(0)). An attempt to 
write to the IA32_SMBASE MSR fails if made as part of a VM exit or part of a VM entry. 


¢ Aread from the IA32_SMBASE MSR using RDMSR generates a general-protection fault (#GP(0)) if executed 
outside of SMM. An attempt to read from the IA32_SMBASE MSR fails if made as part of a VM exit that does not 
end in SMM. 


32.15.6.4 Saving MSRs 


The VM-exit MSR-store area is not used by SMM VM exits that activate the dual-monitor treatment. No MSRs are 
saved into that area. 


32.15.6.5 Loading Host State 


The VMCS that is current during an SMM VM exit that activates the dual-monitor treatment was established by the 
executive monitor. It does not contain the VM-exit controls and host state required to initialize the STM. For this 
reason, such SMM VM exits do not load processor state as described in Section 28.5. Instead, state is set to fixed 
values or loaded based on the content of the MSEG header (see Table 32-10): 


° CRO is set to as follows: 
— PG, NE, ET, MP, and PE are all set to 1. 
— CD and NW are left unchanged. 
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— All other bits are cleared to 0. 
® CR3 is set as follows: 
— Bits 63:32 are cleared on processors that support IA-32e mode. 


— Bits 31:12 are set to bits 31:12 of the sum of the MSEG base address and the CR3-offset field in the MSEG 
header. 


— Bits 11:5 and bits 2:0 are cleared (the corresponding bits in the CR3-offset field in the MSEG header are 
ignored). 


— Bits 4:3 are set to bits 4:3 of the CR3-offset field in the MSEG header. 
° CR¢4 is set as follows: 

— MCE, PGE, CET, PCIDE, and LA57 are cleared. 

— PAE is set to the value of the IA-32e mode SMM feature bit. 


— Ifthe IA-32e mode SMM feature bit is clear, PSE is set to 1 if supported by the processor; if the bit is set, 
PSE is cleared. 


— All other bits are unchanged. 
¢ DR7 is set to 400H. 
¢ The IA32_DEBUGCTL MSR is cleared to OO000000_O00000000H. 
° The registers CS, SS, DS, ES, FS, and GS are loaded as follows: 
— Allregisters are usable. 


— CS.selector is loaded from the corresponding field in the MSEG header (the high 16 bits are ignored), with 
bits 2:0 cleared to O. If the result is OOOOH, CS.selector is set to OOO8H. 


— The selectors for SS, DS, ES, FS, and GS are set to CS.selector+0008H. If the result is OOOOH (if the CS 
selector was FFF8H), these selectors are instead set to OO08H. 


— The base addresses of all registers are cleared to zero. 
— The segment limits for all registers are set to FFFFFFFFH. 
— The AR bytes for the registers are set as follows: 
¢ CS.Type is set to 11 (execute/read, accessed, non-conforming code segment). 
¢ For SS, DS, ES, FS, and GS, the Type is set to 3 (read/write, accessed, expand-up data segment). 
¢ The S bits for all registers are set to 1. 
¢ The DPL for each register is set to 0. 
¢ The P bits for all registers are set to 1. 


* On processors that support Intel 64 architecture, CS.Lis loaded with the value of the IA-32e mode SMM 
feature bit. 


¢ CS.D is loaded with the inverse of the value of the IA-32e mode SMM feature bit. 
¢ For each of SS, DS, ES, FS, and GS, the D/B bit is set to 1. 
¢ The G bits for all registers are set to 1. 


¢ LDTR is unusable. The LDTR selector is cleared to OOOOH, and the register is otherwise undefined (although the 
base address is always canonical) 


° GDTR.base is set to the sum of the MSEG base address and the GDTR base-offset field in the MSEG header 
(bits 63:32 are always cleared on processors that support IA-32e mode). GDTR. limit is set to the corresponding 
field in the MSEG header (the high 16 bits are ignored). 


¢ IDTR.base is unchanged. IDTR. limit is cleared to OOOOH. 


° RIP is set to the sum of the MSEG base address and the value of the RIP-offset field in the MSEG header 
(bits 63:32 are always cleared on logical processors that support IA-32e mode). 


® RSP is set to the sum of the MSEG base address and the value of the RSP-offset field in the MSEG header 
(bits 63:32 are always cleared on logical processor that supports IA-32e mode). 
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¢ RFLAGS is cleared, except bit 1, which is always set. 
¢ The logical processor is left in the active state. 
¢ Event blocking after the SMM VM exit is as follows: 
— There is no blocking by STI or by MOV SS. 
— There is blocking by non-maskable interrupts (NMIs) and by SMIs. 
¢ There are no pending debug exceptions after the SMM VM exit. 


¢ For processors that support IA-32e mode, the IA32_EFER MSR is modified so that LME and LMA both contain 
the value of the IA-32e mode SMM feature bit. 


If any of CR3[63:5], CR4.PAE, CR4.PSE, or IA32_EFER.LMA is changing, the TLBs are updated so that, after 

VM exit, the logical processor does not use translations that were cached before the transition. This is not neces- 
sary for changes that would not affect paging due to the settings of other bits (for example, changes to CR4.PSE if 
IA32_EFER.LMA was 1 before and after the transition). 


32.15.6.6 Loading MSRs 


The VM-exit MSR-load area is not used by SMM VM exits that activate the dual-monitor treatment. No MSRs are 
loaded from that area. 


32.15.7 Deactivating the Dual-Monitor Treatment 


The SMM-transfer monitor may deactivate the dual-monitor treatment and return the processor to default treat- 
ment of SMIs and SMM (see Section 32.14). It does this by executing a VM entry with the “deactivate dual-monitor 
treatment” VM-entry control set to 1. 


As noted in Section 27.2.1.3 and Section 32.15.4.1, an attempt to deactivate the dual-monitor treatment fails in 
the following situations: (1) the processor is not in SMM; (2) the “entry to SMM” VM-entry control is 1; or (3) the 
executive-VMCS pointer does not contain the VMXON pointer (the VM entry is to VMX non-root operation). 


As noted in Section 32.15.4.9, VM entries that deactivate the dual-monitor treatment ignore the SMI bit in the 
interruptibility-state field of the guest-state area. Instead, the blocking of SMIs following such a VM entry depends 
on whether the logical processor is in SMX operation:! 


¢ If the logical processor is in SMX operation, SMIs are blocked after VM entry. SMIs may later be unblocked by 
the VMXOFF instruction (see Section 32.14.4) or by certain leaf functions of the GETSEC instruction (see 
Chapter 7, “Safer Mode Extensions Reference,” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2D). 


¢ If the logical processor is outside SMX operation, SMIs are unblocked after VM entry. 


32.16 SMI AND PROCESSOR EXTENDED STATE MANAGEMENT 


On processors that support processor extended states using XSAVE/XRSTOR (see Chapter 13, “Managing State 
Using the XSAVE Feature Set,” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1), 
the processor does not save any XSAVE/XRSTOR related state on an SMI. It is the responsibility of the SMI handler 
code to properly preserve the state information (including CR4.0SXSAVE, XCRO, and possibly processor extended 
states using XSAVE/XRSTOR). Therefore, the SMI handler must follow the rules described in Chapter 13, 
“Managing State Using the XSAVE Feature Set,” of the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 1. 


1. A logical processor is in SMX operation if GETSEC[SEXIT] has not been executed since the last execution of GETSEC[SENTER]. A logi- 
cal processor is outside SMX operation if GETSEC[SENTER] has not been executed or if GETSEC[SEXIT] was executed after the last 
execution of GETSEC[SENTER]. See Chapter 7, “Safer Mode Extensions Reference,” in the Intel® 64 and IA-32 Architectures Soft- 
ware Developer's Manual, Volume 2D. 
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32.17 MODEL-SPECIFIC SYSTEM MANAGEMENT ENHANCEMENT 


This section describes enhancement of system management features that apply only to the 4th generation Intel 
Core processors. These features are model-specific. BIOS and SMM handler must use CPUID to enumerate Display- 
Family_DisplayModel signature when programming with these interfaces. 


32.17.1 SMM Handler Code Access Control 


The BIOS may choose to restrict the address ranges of code that SMM handler executes. When SMM handler code 
execution check is enabled, an attempt by the SMM handler to execute outside the ranges specified by SMRR (see 
Section 32.4.2.1) will cause the assertion of an unrecoverable machine check exception (MCE). 


The interface to enable SMM handler code access check resides in a per-package scope model-specific register 
MSR_SMM_FEATURE_CONTROL at address 4E0H. An attempt to access MSR_SMM_FEATURE_CONTROL outside of 
SMM will cause a #GP. Writes to MSR_SMM_FEATURE_CONTROL is further protected by configuration interface of 
MSR_SMM_MCA_CAP at address 17DH. 


Details of the interface of MSR_SMM_FEATURE_CONTROL and MSR_SMM_MCA_CAP are described in Table 2-29 in 
Chapter 2, “Model-Specific Registers (MSRs),” of the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 4. 


32.17.2 SMI Delivery Delay Reporting 


Entry into the system management mode occurs at instruction boundary. In situations where a logical processor is 
executing an instruction involving a long flow of internal operations, servicing an SMI by that logical processor will 
be delayed. Delayed servicing of SMI of each logical processor due to executing long flows of internal operation in 
a physical processor can be queried via a package-scope register MSR_SMM_DELAYED at address 4E2H. 


The interface to enable reporting of SMI delivery delay due to long internal flows resides in a per-package scope 
model-specific register MSR_SMM_DELAYED. An attempt to access MSR_SMM_DELAYED outside of SMM will cause 
a #GP. Availability to MSR_SMM_DELAYED is protected by configuration interface of MSR_SMM_MCA_CAP at 
address 17DH. 


Details of the interface of MSR_SMM_DELAYED and MSR_SMM_MCA_CAP are described in Table 2-29 in Chapter 2, 
“Model-Specific Registers (MSRs),” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 
4. 


32.17.3 Blocked SMI Reporting 


A logical processor may have entered into a state and blocked from servicing other interrupts (including SMI). 
Logical processors in a physical processor that are blocked in serving SMI can be queried in a package-scope 
register MSR_SMM_BLOCKED at address 4E3H. An attempt to access MSR_SMM_BLOCKED outside of SMM will 
cause a #GP. 


Details of the interface of MSR_SMM_BLOCKED is described in Table 2-29 in Chapter 2, “Model-Specific Registers 
(MSRs),” of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4. 
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19.Updates to Chapter 1, Volume 4 


Change bars and violet text show changes to Chapter 1 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 4: Model-Specific Registers. 


Changes to this chapter: 


e Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processors to 
the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.” 


Intel® 64 and IA-32 Architectures Software Developer’s Manual Documentation Changes 21 


CHAPTER 1 
ABOUT THIS MANUAL 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 4: Model-Specific Registers (order 
number 335592) is part of a set that describes the architecture and programming environment of Intel® 64 and IA- 
32 architecture processors. Other volumes in this set are: 


* Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture (order number 
253665). 


* Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 2A, 2B, 2C, & 2D: Instruction Set 
Reference (order numbers 253666, 253667, 326018, and 334569). 


* The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D: System 
Programming Guide (order numbers 253668, 253669, 326019, and 332831). 


The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, describes the basic architecture 
and programming environment of Intel 64 and IA-32 processors. The Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volumes 2A, 2B, 2C, & 2D, describe the instruction set of the processor and the opcode struc- 
ture. These volumes apply to application programmers and to programmers who write operating systems or exec- 
utives. The Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volumes 3A, 3B, 3C, & 3D, describe 
the operating-system support environment of Intel 64 and IA-32 processors. These volumes target operating- 
system and BIOS designers. In addition, the Intel® 64 and IA-32 Architectures Software Developer’s Manual, 
Volume 3B, and the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3C, address the 
programming environment for classes of software that host operating systems. The Intel® 64 and IA-32 Architec- 
tures Software Developer’s Manual, Volume 4, describes the model-specific registers of Intel 64 and IA-32 proces- 
sors. 


1.1 INTEL® 64 AND IA-32 PROCESSORS COVERED IN THIS MANUAL 


This manual set includes information pertaining primarily to the most recent Intel 64 and IA-32 processors, which 
include: 


* Pentium® processors 

¢ P6 family processors 

* Pentium® 4 processors 

* Pentium® M processors 

* Intel® Xeon® processors 

* Pentium® D processors 

* Pentium® processor Extreme Editions 

* 64-bit Intel® Xeon® processors 

* Intel® Core™ Duo processor 

* Intel® Core™ Solo processor 

* Dual-Core Intel® Xeon® processor LV 

* Intel® Core™ 2 Duo processor 

* Intel® Core™ 2 Quad processor Q6000 series 
* Intel® xeon® processor 3000, 3200 series 

* Intel® Xeon® processor 5000 series 

* Intel® xeon® processor 5100, 5300 series 

* Intel® Core™ 2 Extreme processor X7000 and X6800 series 
* Intel® Core™ 2 Extreme QX6000 series 


Vol.4 1-1 


ABOUT THIS MANUAL 


* Intel® Xeon® processor 7100 series 

* Intel® Pentium® Dual-Core processor 

* Intel® Xeon® processor 7200, 7300 series 

* Intel® Core™ 2 Extreme QX9000 series 

* Intel® Xeon® processor 5200, 5400, 7400 series 

* Intel® Core™ 2 Extreme processor QX9000 and X9000 series 
* Intel® Core™ 2 Quad processor Q9000 series 

* Intel® Core™ 2 Duo processor E8000, T9000 series 


* Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are built from 45 nm and 32 nm processes. 


* Intel® Core™ i7 processor 

* Intel® Core™ i5 processor 

* Intel® Xeon® processor E7-8800/4800/2800 product families 
* Intel® Core™ i7-3930K processor 

* 2nd generation Intel® Core™ i7-2xxx, Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series 
* Intel® Xeon® processor E3-1200 product family 

* Intel® Xeon® processor E5-2400/1400 product family 

* Intel® Xeon® processor E5-4600/2600/1600 product family 
* 3rd generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1200 v2 product family 

* Intel® Xeon® processor E5-2400/1400 v2 product families 

* Intel® Xeon® processor E5-4600/2600/1600 v2 product families 
* Intel® Xeon® processor E7-8800/4800/2800 v2 product families 
* 4th generation Intel® Core™ processors 

* The Intel® Core™ M processor family 

* Intel® Core™ i7-59xx Processor Extreme Edition 

* Intel® Core™ i7-49xx Processor Extreme Edition 

* Intel® Xeon® processor E3-1200 v3 product family 

* Intel® Xeon® processor E5-2600/1600 v3 product families 

* 5th generation Intel® Core™ processors 

* Intel® Xeon® processor D-1500 product family 

* Intel® Xeon® processor E5 v4 family 

* Intel Atom® processor X7-Z8000 and X5-Z8000 series 

* Intel Atom® processor Z3400 series 

* Intel Atom® processor Z3500 series 

* 6th generation Intel® Core™ processors 

* Intel® Xeon® processor E3-1500m v5 product family 

* 7th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series 

* Intel® Xeon® Scalable Processor Family 

* 8th generation Intel® Core™ processors 

* Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 

* Intel® Xeon® E processors 

* 9th generation Intel® Core™ processors 
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* 2nd generation Intel® Xeon® Scalable Processor Family 
* 10th generation Intel® Core™ processors 

* 11th generation Intel® Core™ processors 

* 3rd generation Intel® Xeon® Scalable Processor Family 
* 12th generation Intel® Core™ processors 

* 13th generation Intel® Core™ processors 

* 4th generation Intel® Xeon® Scalable Processor Family 
* 5th generation Intel® Xeon® Scalable Processor Family 
* Intel® Core™ Ultra 7 processors 


P6 family processors are IA-32 processors based on the P6 family microarchitecture. This includes the Pentium® 
Pro, Pentium® II, Pentium® III, and Pentium® III Xeon® processors. 


The Pentium® 4, Pentium® D, and Pentium® processor Extreme Editions are based on the Intel NetBurst® micro- 
architecture. Most early Intel® Xeon® processors are based on the Intel NetBurst® microarchitecture. Intel Xeon 
processor 5000, 7100 series are based on the Intel NetBurst® microarchitecture. 


The Intel® Core™ Duo, Intel® Core™ Solo and dual-core Intel® Xeon® processor LV are based on an improved 
Pentium® M processor microarchitecture. 


The Intel® Xeon® processor 3000, 3200, 5100, 5300, 7200, and 7300 series, Intel® Pentium® dual-core, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Quad, and Intel® Core™ 2 Extreme processors are based on Intel® Core™ microar- 
chitecture. 


The Intel® Xeon® processor 5200, 5400, 7400 series, Intel® Core™ 2 Quad processor Q9000 series, and Intel® 
Core™ 2 Extreme processors QX9000, X9000 series, Intel® Core™ 2 processor E8000 series are based on 
Enhanced Intel® Core™ microarchitecture. 


The Intel Atom® processors 200, 300, D400, D500, D2000, N200, N400, N2000, E2000, Z500, Z600, Z2000, 
C1000 series are based on the Intel Atom® microarchitecture and supports Intel 64 architecture. 


P6 family, Pentium® M, Intel® Core™ Solo, Intel® Core™ Duo processors, dual-core Intel® Xeon® processor LV, 
and early generations of Pentium 4 and Intel Xeon processors support IA-32 architecture. The Intel® Atom™ 
processor Z5xx series support IA-32 architecture. 


The Intel® Xeon® processor 3000, 3200, 5000, 5100, 5200, 5300, 5400, 7100, 7200, 7300, 7400 series, Intel® 
Core™ 2 Duo, Intel® Core™ 2 Extreme, Intel® Core™ 2 Quad processors, Pentium® D processors, Pentium® Dual- 
Core processor, newer generations of Pentium 4 and Intel Xeon processor family support Intel® 64 architecture. 


The Intel® Core™ i7 processor and Intel® Xeon® processor 3400, 5500, 7500 series are based on 45 nm Nehalem 
microarchitecture. Westmere microarchitecture is a 32 nm version of the Nehalem microarchitecture. Intel® 
Xeon® processor 5600 series, Intel Xeon processor E7 and various Intel Core i7, i5, i3 processors are based on the 
Westmere microarchitecture. These processors support Intel 64 architecture. 


The Intel® Xeon® processor E5 family, Intel® Xeon® processor E3-1200 family, Intel® Xeon® processor E7- 
8800/4800/2800 product families, Intel® Core™ i7-3930K processor, and 2nd generation Intel® Core™ i7-2xxx, 
Intel® Core™ i5-2xxx, Intel® Core™ i3-2xxx processor series are based on the Sandy Bridge microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® processor E7-8800/4800/2800 v2 product families, Intel® Xeon® processor E3-1200 v2 product 
family and 3rd generation Intel® Core™ processors are based on the Ivy Bridge microarchitecture and support 
Intel 64 architecture. 


The Intel® Xeon® processor E5-4600/2600/1600 v2 product families, Intel® Xeon® processor E5-2400/1400 v2 
product families and Intel® Core™ i7-49xx Processor Extreme Edition are based on the Ivy Bridge-E microarchitec- 
ture and support Intel 64 architecture. 


The Intel® Xeon® processor E3-1200 v3 product family and 4th Generation Intel® Core™ processors are based on 
the Haswell microarchitecture and support Intel 64 architecture. 


The Intel® Xeon® processor E5-2600/1600 v3 product families and the Intel® Core™ i7-59xx Processor Extreme 
Edition are based on the Haswell-E microarchitecture and support Intel 64 architecture. 


The Intel Atom® processor Z8000 series is based on the Airmont microarchitecture. 
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The Intel Atom® processor Z3400 series and the Intel Atom® processor Z3500 series are based on the Silvermont 
microarchitecture. 


The Intel® Core™ M processor family, 5th generation Intel® Core™ processors, Intel® Xeon® processor D-1500 
product family and the Intel® Xeon® processor E5 v4 family are based on the Broadwell microarchitecture and 
support Intel 64 architecture. 


The Intel® Xeon® Scalable Processor Family, Intel® Xeon® processor E3-1500m v5 product family and 6th gener- 
ation Intel® Core™ processors are based on the Skylake microarchitecture and support Intel 64 architecture. 


The 7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture and support Intel 64 
architecture. 


The Intel Atom® processor C series, the Intel Atom® processor X series, the Intel® Pentium® processor J series, 
the Intel® Celeron® processor J series, and the Intel® Celeron® processor N series are based on the Goldmont 
microarchitecture. 


The Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series is based on the Knights Landing microarchitecture and 
supports Intel 64 architecture. 


The Intel® Pentium® Silver processor series, the Intel® Celeron® processor J series, and the Intel® Celeron® 
processor N series are based on the Goldmont Plus microarchitecture. 


The 8th generation Intel® Core™ processors, 9th generation Intel® Core™ processors, and Intel® Xeon® E proces- 
sors are based on the Coffee Lake microarchitecture and support Intel 64 architecture. 


The Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series is based on the Knights Mill microarchitecture and 
supports Intel 64 architecture. 


The 2nd generation Intel® Xeon® Scalable Processor Family is based on the Cascade Lake product and supports 
Intel 64 architecture. 


Some 10th generation Intel® Core™ processors are based on the Ice Lake microarchitecture, and some are based 
on the Comet Lake microarchitecture; both support Intel 64 architecture. 


Some 11th generation Intel® Core™ processors are based on the Tiger Lake microarchitecture, and some are 
based on the Rocket Lake microarchitecture; both support Intel 64 architecture. 


Some 3rd generation Intel® Xeon® Scalable Processor Family processors are based on the Cooper Lake product, 
and some are based on the Ice Lake microarchitecture; both support Intel 64 architecture. 


The 12th generation Intel® Core™ processors are based on the Alder Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 13th generation Intel® Core™ processors are based on the Raptor Lake performance hybrid architecture and 
support Intel 64 architecture. 


The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and 
supports Intel 64 architecture. 


The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and 
supports Intel 64 architecture. 


The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and supports Intel 64 architecture. 


IA-32 architecture is the instruction set architecture and programming environment for Intel's 32-bit microproces- 
sors. Intel® 64 architecture is the instruction set architecture and programming environment which is the superset 
of Intel’s 32-bit and 64-bit architectures. It is compatible with the IA-32 architecture. 


1.2 OVERVIEW OF THE MODEL-SPECIFIC REGISTERS 


A description of this manual’s content follows: 


Chapter 1 — About This Manual. Gives an overview of all volumes of the Intel® 64 and IA-32 Architectures Soft- 
ware Developer’s Manual. It also describes the notational conventions in these manuals and lists related Intel 
manuals and documentation of interest to programmers and hardware designers. 
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Chapter 2 — Model-Specific Registers (MSRs). Lists the MSRs available in Intel processors, and describes their 
functions. 


1.3 NOTATIONAL CONVENTIONS 


This manual uses specific notation for data-structure formats, for symbolic representation of instructions, and for 
hexadecimal and binary numbers. A review of this notation makes the manual easier to read. 


1.3.1 Bit and Byte Order 


In illustrations of data structures in memory, smaller addresses appear toward the bottom of the figure; addresses 
increase toward the top. Bit positions are numbered from right to left. The numerical value of a set bit is equal to 

two raised to the power of the bit position. Intel 64 and IA-32 processors are “little endian” machines; this means 
the bytes of a word are numbered starting from the least significant byte. Figure 1-1 illustrates these conventions. 


1.3.2 Reserved Bits and Software Compatibility 


In many register and memory layout descriptions, certain bits are marked as reserved. When bits are marked as 
reserved, it is essential for compatibility with future processors that software treat these bits as having a future, 
though unknown, effect. The behavior of reserved bits should be regarded as not only undefined, but unpredict- 
able. Software should follow these guidelines in dealing with reserved bits: 


* Do not depend on the states of any reserved bits when testing the values of registers which contain such bits. 
Mask out the reserved bits before testing. 


* Do not depend on the states of any reserved bits when storing to memory or to a register. 
* Do not depend on the ability to retain information written into any reserved bits. 


¢ When loading a register, always load the reserved bits with the values indicated in the documentation, if any, 
or reload them with values previously read from the same register. 


NOTE 


Avoid any software dependence upon the state of reserved bits in Intel 64 and IA-32 registers. 
Depending upon the values of reserved register bits will make software dependent upon the 
unspecified manner in which the processor handles these bits. Programs that depend upon 
reserved values risk incompatibility with future processors. 


Data Structure 


Highest ; 
Address 2! 24 23 16 15 8 7 0 ~«— Bit offset 


Lowest 
Address 


Byte Offset 


Figure 1-1. Bit and Byte Order 
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1.33 Instruction Operands 


When instructions are represented symbolically, a subset of assembly language is used. In this subset, an instruc- 
tion has the following format: 
label: mnemonic argument1, argument2, arqgument3 
where: 
¢ A label is an identifier which is followed by a colon. 
¢ Amnemonic is a reserved name for a class of instruction opcodes which have the same function. 


¢ The operands argumenti, argument2, and argument3 are optional. There may be from zero to three 
operands, depending on the opcode. When present, they take the form of either literals or identifiers for data 
items. Operand identifiers are either reserved names of registers or are assumed to be assigned to data items 
declared in another part of the program (which may not be shown in the example). 


When two operands are present in an arithmetic or logical instruction, the right operand is the source and the left 
operand is the destination. 


For example: 


LOADREG: MOV EAX, SUBTOTAL 


In this example LOADREG is a label, MOV is the mnemonic identifier of an opcode, EAX is the destination operand, 
and SUBTOTAL is the source operand. Some assembly languages put the source and destination in reverse order. 


1.3.4 Hexadecimal and Binary Numbers 


Base 16 (hexadecimal) numbers are represented by a string of hexadecimal digits followed by the character H (for 
example, F82EH). A hexadecimal digit is a character from the following set: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, 
E, and F. 


Base 2 (binary) numbers are represented by a string of 1s and Os, sometimes followed by the character B (for 
example, 1010B). The “B” designation is only used in situations where confusion as to the type of number might 
arise. 


1.3.5 Segmented Addressing 


The processor uses byte addressing. This means memory is organized and accessed as a sequence of bytes. 
Whether one or more bytes are being accessed, a byte address is used to locate the byte or bytes memory. The 
range of memory that can be addressed is called an address space. 


The processor also supports segmented addressing. This is a form of addressing where a program may have many 
independent address spaces, called segments. For example, a program can keep its code (instructions) and stack 
in separate segments. Code addresses would always refer to the code space, and stack addresses would always 
refer to the stack space. The following notation is used to specify a byte address within a segment: 


Segment-register: Byte-address 


For example, the following segment address identifies the byte at address FF79H in the segment pointed by the DS 
register: 


DS:FF79H 


The following segment address identifies an instruction address in the code segment. The CS register points to the 
code segment and the EIP register contains the address of the instruction. 


CS:EIP 
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1.3.6 Syntax for CPUID, CR, and MSR Values 


Obtain feature flags, status, and system information by using the CPUID instruction, by checking control register 
bits, and by reading model-specific registers. We are moving toward a single syntax to represent this type of infor- 
mation. See Figure 1-2. 


CPUID Input and Output 


CPUID.01H:EDX.SSE[bit 25] = 1 


Input value for EAX register 


Output register and feature flag or field 
name with bit position(s) 


Value (or range) of output 


Control Register Values 


CR4.OSFXSRIbit 9] = 1 
| 


Example CR name 


Feature flag or field name 
with bit position(s) 


Value (or range) of output 


Model-Specific Register Values 


IA32_MISC_ENABLE.ENABLEFOPCODE[bit 2] = 1 


Example MSR name 


Feature flag or field name with bit position(s) 


Value (or range) of output 


Figure 1-2. Syntax for CPUID, CR, and MSR Data Presentation 


1.3.7 Exceptions 


An exception is an event that typically occurs when an instruction causes an error. For example, an attempt to 
divide by zero generates an exception. However, some exceptions, such as breakpoints, occur under other condi- 
tions. Some types of exceptions may provide error codes. An error code reports additional information about the 
error. An example of the notation used to show an exception and error code is shown below: 


#PF(fault code) 


This example refers to a page-fault exception under conditions where an error code naming a type of fault is 
reported. Under some conditions, exceptions which produce error codes may not be able to report an accurate 
code. In this case, the error code is zero, as shown below for a general-protection exception: 


#GP(0) 
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1.4 RELATED LITERATURE 


Literature related to Intel 64 and IA-32 processors is listed and viewable on-line at: 


https://software.intel.com/en-us/articles/intel-sdm 


See also: 


The latest security information on Intel® products: 
https://www.intel.com/content/www/us/en/security-center/default.html 


Software developer resources, guidance, and insights for security advisories: 
https://software.intel.com/security-software-guidance/ 


The data sheet for a particular Intel 64 or IA-32 processor 
The specification update for a particular Intel 64 or IA-32 processor 


Intel® C++ Compiler documentation and online help: 
http: //software.intel.com/en-us/articles/intel-compilers/ 


Intel® Fortran Compiler documentation and online help: 
http://software.intel.com/en-us/articles/intel-compilers/ 


Intel® Software Development Tools: 
https://software.intel.com/en-us/intel-sdp-home 


Intel® 64 and IA-32 Architectures Software Developer’s Manual (in one, four, or ten volumes): 
https://software.intel.com/en-us/articles/intel-sdm 


Intel® 64 and IA-32 Architectures Optimization Reference Manual: 
https://software.intel.com/en-us/articles/intel-sdm#optimization 


Intel® Trusted Execution Technology Measured Launched Environment Programming Guide: 
http://www. intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html 


Intel® Software Guard Extensions (Intel® SGX) Information: 
https://software.intel.com/en-us/isa-extensions/intel-sgx 


Developing Multi-threaded Applications: A Platform Consistent Approach: 
https://software.intel.com/sites/default/files/article/147714/51534-developing-multithreaded-applica- 
tions. pdf 


Using Spin-Loops on Intel® Pentium® 4 Processor and Intel® Xeon® Processor: 
https://software.intel.com/sites/default/files/22/30/25602 


Performance Monitoring Unit Sharing Guide: 
http://software.intel.com/file/30388 


Literature related to select features in future Intel processors are available at: 


Intel® Architecture Instruction Set Extensions Programming Reference: 
https://software.intel.com/en-us/isa-extensions 


More relevant links are: 


Intel® Developer Zone: 

https://software.intel.com/en-us 

Developer centers: 

http://www. intel.com/content/www/us/en/hardware-developers/developer-centers.html 
Processor support general link: 

http://www.intel.com/support/processors/ 

Intel® Hyper-Threading Technology (Intel® HT Technology): 

http://www. intel.com/technology/platform-technology/hyper-threading/index.htm 
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Change bars and violet text show changes to Chapter 2 of the Intel® 64 and IA-32 Architectures Software 
Developer’s Manual, Volume 4: Model-Specific Registers. 


Changes to this chapter: 
e Chapter 1: 
— Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processor 
to the list of supported processors in Section 1.1, “Intel® 64 and IA-32 Processors Covered in this Manual.” 
e Chapter 2: 


— Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 processor 
to Table 2-1, “CPUID Signature Values of DisplayFamily_DisplayModel.” 


— Added the following architectural MSRs: 
e JA32_FEATURE_ACTIVATION (7AH) 
e IA32_MC29_CTL (474H) 

e = JA32_MC29_STATUS (475H) 
e IA32_MC29_ADDR (476H) 

e IA32_MC29_MISC (477H) 

e JA32_MC30_CTL (478H) 

e JA32_MC30_STATUS (479H) 
e IA32_MC30_ADDR (47AH) 

¢ IA32_MC30_MISC (47BH) 

e = JA32_MC31_CTL (47CH) 

e IA32_MC31_STATUS (47DH) 
e IA32_MC31_ADDR (47EH) 

e IA32_MC31_MISC (47FH) 


e JA32_TME_CLEAR_SAVED_KEY (9FBH) 
— Updated the IA32_MCG_STATUS MSR (17AH) to show the MSR is R/W, not R/W0O as previously indicated. 
— Updated the IA32_TME_CAPABILITY MSR (981H) to add bit 30 details. 


— Added the 5th generation Intel® Xeon® Scalable Processor Family and the Intel® Core™ Ultra 7 
processors to Section 2.17, “MSRs In the 6th-13th Generation Intel® Core™ Processors, 1st-5th 
Generation Intel® Xeon® Scalable Processor Families, Intel® Core™ Ultra 7 Processors, 8th Generation 
Intel® Core™ i3 Processors, and Intel® Xeon® E Processors.” 


— Added the 5th generation Intel® Xeon® Scalable Processor Family to Section 2.17.8, “MSRs Specific to the 
4th and 5th Generation Intel® Xeon® Scalable Processor Families.” 


— Added Section 2.17.9, “MSRs Introduced in the Intel® Core™ Ultra 7 Processor Supporting Performance 
Hybrid Architecture.” 


— Updated the layout of the MSR tables. No information was changed in the update. 
— Removed MSR index. 


— Typo corrections as necessary. If the correction does not change the meaning of the material, it is not 
marked with change bars or violet font. 
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CHAPTER 2 
MODEL-SPECIFIC REGISTERS (MSRS) 


This chapter lists MSRs across Intel processor families. All MSRs listed can be read with the RDMSR and written with 
the WRMSR instructions. The scope of an MSR defines the set of processors that access the same MSR with RDMSR 
and WRMSR. Thread-scope MSRs are unique to every logical processor. Core-scope MSRs are shared by the threads 
in the same core; similarly for module-scope, die-scope, and package-scope. 


When a processor package contains a single die, die-scope and package-scope are synonymous. When a package 
contains multiple die, they are distinct. 


NOTE 


For information on hierarchical level types supported, refer to the CPUID Leaf 1FH definition for the 
actual level type numbers: “V2 Extended Topology Enumeration Leaf” in the Intel® 64 and IA-32 
Architectures Software Developer’s Manual, Volume 2A. Also see Section 9.9.1, “Hierarchical 
Mapping of Shared Resources,” in the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 3A. 


Register addresses are given in both hexadecimal and decimal. The register name is the mnemonic register name 
and the bit description describes individual bits in registers. 


Model specific registers and its bit-fields may be supported for a finite range of processor families/models. To distin- 
guish between different processor family and/or models, software must use CPUID.01H leaf function to query the 
combination of DisplayFamily and DisplayModel to determine model-specific availability of MSRs (see CPUID 
instruction in Chapter 3, “Instruction Set Reference, A-L,” in the Intel® 64 and IA-32 Architectures Software Devel- 
oper’s Manual, Volume 2A). Table 2-1 lists the signature values of DisplayFamily and DisplayModel for various 
processor families or processor number series. 


Table 2-1. CPUID Signature Values of DisplayFamily_DisplayModel 
DisplayFamily_DisplayModel | Processor Families/Processor Number Series 


06_85H Intel? Xeon Phi™ Processor 7215, 7285, 7295 Series based on Knights Mill microarchitecture 
06_57H Intel®? Xeon Phi™ Processor 3200, 5200, 7200 Series based on Knights Landing microarchitecture 
06_AAH Intel® Core™ Ultra 7 processors supporting Meteor Lake performance hybrid architecture 

06_CFH 5th generation Intel® Xeon® Scalable Processor Family based on Emerald Rapids microarchitecture 
06_8FH 4th generation Intel® Xeon® Scalable Processor Family based on Sapphire Rapids microarchitecture 


06_BAH, 06_B7H, 06_BFH | 13th generation Intel® Core™ processors supporting Raptor Lake performance hybrid architecture 


06_97H, 06_9AH 12th generation Intel® Core™ processors supporting Alder Lake performance hybrid architecture 
06_8CH, 06_8DH 11th generation Intel® Core™ processors based on Tiger Lake microarchitecture 

06_A7H 11th generation Intel’ Core™ processors based on Rocket Lake microarchitecture 

06_7DH, 06_7EH 10th generation Intel® Core™ processors based on Ice Lake microarchitecture 

06_A5H, 06_A6H 10th generation Intel® Core™ processors based on Comet Lake microarchitecture 

06_66H Intel® Core™ processors based on Cannon Lake microarchitecture 

06_8EH, 06_9EH 7th generation Intel® Core™ processors based on Kaby Lake microarchitecture, 8th and 9th generation 


Intel? Core™ processors based on Coffee Lake microarchitecture, Intel® Xeon® € processors based on 
Coffee Lake microarchitecture 


06_6AH, 06_6CH 3rd generation Intel® Xeon® Scalable Processor Family based on Ice Lake microarchitecture 


06_55H Intel® Xeon® Scalable Processor Family based on Skylake microarchitecture, 2nd generation Intel® 
Xeon® Scalable Processor Family based on Cascade Lake product, and 3rd generation Intel’ Xeon® 
Scalable Processor Family based on Cooper Lake product 
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Table 2-1. CPUID Signature Values of DisplayFamily_DisplayModel (Contd.) 


DisplayFamily_DisplayModel 


Processor Families/Processor Number Series 


06_4€H, 06_5€H 


6th generation Intel Core processors and Intel Xeon processor E3-1500m v5 product family and E3- 
1200 v5 product family based on Skylake microarchitecture 


06_56H Intel Xeon processor D-1500 product family based on Broadwell microarchitecture 

06_4FH Intel Xeon processor E5 v4 Family based on Broadwell microarchitecture, Intel Xeon processor E7 v4 
Family, Intel Core i7-69xx Processor Extreme Edition 

06_47H 5th generation Intel Core processors, Intel Xeon processor E3-1200 v4 product family based on 
Broadwell microarchitecture 

06_3DH Intel Core M-5xxx Processor, 5th generation Intel Core processors based on Broadwell 
microarchitecture 

06_3FH Intel Xeon processor E5-4600/2600/1600 v3 product families, Intel Xeon processor E7 v3 product 


families based on Haswell-E microarchitecture, Intel Core i7-59xx Processor Extreme Edition 


06_3CH, 06_45H, 06_46H 


Ath Generation Intel Core processor and Intel Xeon processor E3-1200 v3 product family based on 
Haswell microarchitecture 


06_3EH Intel Xeon processor E7-8800/4800/2800 v2 product families based on Ivy Bridge-E 
microarchitecture 

06_3EH Intel Xeon processor €5-2600/1600 v2 product families and Intel Xeon processor E5-2400 v2 
product family based on Ivy Bridge-E microarchitecture, Intel Core i7-49xx Processor Extreme Edition 

06_3AH 3rd Generation Intel Core Processor and Intel Xeon processor €3-1200 v2 product family based on Ivy 
Bridge microarchitecture 

06_2DH Intel Xeon processor E5 Family based on Sandy Bridge microarchitecture, Intel Core i7-39xx 
Processor Extreme Edition 

06_2FH Intel Xeon Processor E7 Family 

06_2AH Intel Xeon processor €3-1200 product family; 2nd Generation Intel Core i7, i5, i3 Processors 2xxx 
Series 

06_2EH Intel Xeon processor 7500, 6500 series 


06_25H, 06_2CH 


Intel Xeon processors 3600, 5600 series, Intel Core i7, i5, and i3 Processors 


06_1€H, 06_1FH 


Intel Core i7 and iS Processors 


06_1AH Intel Core i7 Processor, Intel Xeon processor 3400, 3500, 5500 series 

06_1DH Intel Xeon processor MP 7400 series 

06_17H Intel Xeon processor 3100, 3300, 5200, 5400 series, Intel Core 2 Quad processors 8000, 9000 
series 

06_OFH Intel Xeon processor 3000, 3200, 5100, 5300, 7300 series, Intel Core 2 Quad processor 6000 series, 
Intel Core 2 Extreme 6000 series, Intel Core 2 Duo 4000, 5000, 6000, 7000 series processors, Intel 
Pentium dual-core processors 

06_0EH Intel Core Duo, Intel Core Solo processors 

06_0DH Intel Pentium M processor 


06_86H, 06_96H, 06_9CH 


Intel Atom® processors, Intel® Celeron® processors, Intel® Pentium® processors, and Intel® Pentium® 
Silver processors based on Tremont Microarchitecture 


06_7AH Intel Atom processors based on Goldmont Plus microarchitecture 

06_5FH Intel Atom processors based on Goldmont microarchitecture (Denverton) 

06_5CH Intel Atom processors based on Goldmont microarchitecture 

06_4CH Intel Atom processor X7-Z8000 and X5-Z8000 series based on Airmont microarchitecture 
06_5DH Intel Atom processor X3-C3000 based on Silvermont microarchitecture 

06_5AH Intel Atom processor Z3500 series 

06_4AH Intel Atom processor Z3400 series 
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Table 2-1. CPUID Signature Values of DisplayFamily_DisplayModel (Contd.) 
DisplayFamily_DisplayModel | Processor Families/Processor Number Series 


06_37H Intel Atom processor E3000 series, 23600 series, 23700 series 
06_4DH Intel Atom processor C2000 series 
06_36H Intel Atom processor $1000 Series 


06_1CH, 06_26H, 06_27H, | Intel Atom processor family, Intel Atom processor D2000, N2000, E2000, Z2000, C1000 series 
06_35H, 06_36H 


OF_O6H Intel Xeon processor 7100, 5000 Series, Intel Xeon Processor MP, Intel Pentium 4, Pentium D 
processors 

OF_03H, OF_04H Intel Xeon processor, Intel Xeon processor MP, Intel Pentium 4, Pentium D processors 

06_09H Intel Pentium M processor 

OF_O2H Intel Xeon Processor, Intel Xeon processor MP, Intel Pentium 4 processors 

OF_OH, OF_01H Intel Xeon Processor, Intel Xeon processor MP, Intel Pentium 4 processors 

06_7H, 06_08H, 06_0AH, Intel Pentium III Xeon processor, Intel Pentium III processor 

06_OBH 

06_03H, 06_05H Intel Pentium II Xeon processor, Intel Pentium I! processor 

06_01H Intel Pentium Pro processor 


05_01H, 05_02H, 05_04H _ | Intel Pentium processor, Intel Pentium processor with MMX Technology 


The Intel? Quark™ SoC X1000 processor can be identified by the signature of DisplayFamily_DisplayModel = 05_09H and 
SteppingID = 0 


2.1 ARCHITECTURAL MSRS 


Many MSRs have carried over from one generation of IA-32 processors to the next and to Intel 64 processors. A 
subset of MSRs and associated bit fields, which do not change on future processor generations, are now considered 
architectural MSRs. For historical reasons (beginning with the Pentium 4 processor), these “architectural MSRs” 
were given the prefix “IA32_”. Table 2-2 lists the architectural MSRs, their addresses, their current names, their 
names in previous IA-32 processors, and bit fields that are considered architectural. MSR addresses outside Table 
2-2 and certain bit fields in an MSR address that may overlap with architectural MSR addresses are model-specific. 
Code that accesses a model-specific MSR and that is executed on a processor that does not support that MSR will 
generate an exception. 

Architectural MSR or individual bit fields in an architectural MSR may be introduced or transitioned at the granu- 
larity of certain processor family/model or the presence of certain CPUID feature flags. The right-most column of 
Table 2-2 provides information on the introduction of each architectural MSR or its individual fields. This informa- 
tion is expressed either as signature values of “DF_DM” (see Table 2-1) or via CPUID flags. 


Certain bit field position may be related to the maximum physical address width, the value of which is expressed 
as “MAXPHYADDR” in Table 2-2. “MAXPHYADDR” is reported by CPUID.8000_OOO8H leaf. 


MSR address range between 40000000H - 4000FFFFH is marked as a specially reserved range. All existing and 
future processors will not implement any features using any MSR in this range. 


Table 2-2. IA-32 Architectural MSRs 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
Register Address: OH, 0 1A32_P5_MC_ADDR (P5_MC_ADDR) 
See Section 2.23, “MSRs in Pentium Processors.” Pentium Processor (05_01H) 
Register Address: 1H, 1 IA32_P5_MC_TYPE (P5_MC_TYPE) 
See Section 2.23, “MSRs in Pentium Processors.” DF_DM = 05_01H 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination.” OF_03H 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER (TSC) 
See Section 18.17, “Time-Stamp Counter.” 05_01H 
Register Address: 17H, 23 IA32_PLATFORM_ID (MSR_PLATFORM_ID) 
Platform ID (R/O) 06_01H 


The operating system can use this MSR to determine “slot” information for the processor and the 
proper microcode update to load. 


49:0 Reserved. 
52:50 Platform ID (R/O) 
Contains information concerning the intended platform for the 
processor. 
52 51 50 
0 O 0 Processor Flag 0 
0 O 1 Processor Flag 1 
O 1  O- Processor Flag 2 
QO 1 1 Processor Flag 3 
1 0 0O- Processor Flag 4 
1 0 1 Processor Flag 5 
1 1. O- Processor Flag 6 
1 1 = #1 Processor Flag 7 
63:53 Reserved. 
Register Address: 1BH, 27 IA32_APIC_BASE (APIC_BASE) 


This register holds the APIC base address, permitting the relocation of the APIC memory map. See | O6_01H 
Section 11.4.4, “Local APIC Status and Location,” and Section 11.4.5, “Relocating the Local APIC 


Registers.” 

7:0 Reserved. 

8 BSP Flag (R/W) 

9 Reserved. 

10 Enable x2APIC mode. 06_1AH 
iL APIC Global Enable (R/W) 

(MAXPHYADDR -1):12 | APIC Base (R/W) 

63: MAXPHYADDR Reserved. 


Register Address: 3AH, 58 IA32_FEATURE_CONTROL 


Control Features in Intel 64 Processor (R/W) If any one enumeration condition 
for defined bit field holds. 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 

0 Lock bit (R/WO): (1 = locked). If any one enumeration condition 
When set, locks this MSR from being written; writes to this bit will result | fr defined bit field position 
in GP(O). greater than bit O holds. 
Note: Once the Lock bit is set, the contents of this register cannot be 
modified. Therefore the lock bit must be set after configuring support for 
Intel Virtualization Technology and prior to transferring control to an 
option ROM or the OS. Hence, once the Lock bit is set, the entire 
IA32_FEATURE_CONTROL contents are preserved across RESET when 
PWRGOOD is not deasserted. 

1 Enable VMX inside SMX operation (R/WL) This bit enables a system If CPUID.O1H:ECX[5] = 1 && 
executive to use VMX in conjunction with SMX to support Intel® Trusted | CPUID.O1H:ECX[6] = 1 
Execution Technology. 
BIOS must set this bit only when the CPUID function 1 returns VMX 
feature flag and SMX feature flag set (ECX bits 5 and 6 respectively). 

2 Enable VMX outside SMX operation (R/WL) This bit enables VMX for a If CPUID.O1H:ECX[5] = 1 
system executive that does not require SMX. 
BIOS must set this bit only when the CPUID function 1 returns the VMX 
feature flag set (ECX bit 5). 

7:3 Reserved. 

14:8 SENTER Local Function Enables (R/WL) When set, each bit in the field If CPUID.O1H:ECX[6] = 1 
represents an enable control for a corresponding SENTER function. This 
field is supported only if CPUID.1:ECX.[bit 6] is set. 

15 SENTER Global Enable (R/WL) If CPUID.O1H:ECX[6] = 1 
This bit must be set to enable SENTER leaf functions. This bit is 
supported only if CPUID.1:ECX.[bit 6] is set. 

16 Reserved. 

17 SGX Launch Control Enable (R/WL) If CPUID.(EAX=07H, ECX=OH): 
This bit must be set to enable runtime re-configuration of SGX Launch ECX[30] = 1 
Control via the [A32_SGXLEPUBKEYHASHn MSR. 

18 SGX Global Enable (R/WL) If CPUID.(EAX=07H, ECX=0H): 
This bit must be set to enable SGX leaf functions. EBX[2] = 1 

19 Reserved. 

20 LMCE On (R/WL) If IA32_MCG_CAP[27] = 1 
When set, system software can program the MSRs associated with LMCE 
to configure delivery of some machine check exceptions to a single 
logical processor. 

63:21 Reserved. 


Register Address: 3BH, 59 IA32_TSC_ADJUST 


Per Logical Processor TSC Adjust (R/Write to clear) 


If CPUID.(EAX=07H, ECX=0H): 
EBX[1] = 1 


63:0 


THREAD_ADJUST 

Local offset value of the [A32_TSC for a logical processor. Reset value is 
zero. A write to [A32_TSC will modify the local offset in 
IA32_TSC_ADJUST and the content of |[A32_TSC, but does not affect the 
internal invariant TSC hardware. 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Register Address: 48H, 72 


IA32_SPEC_CTRL 


Speculation Control (R/W) 


The MSR bits are defined as logical processor scope. On some core implementations, the bits may 
impact sibling logical processors on the same core. 


This MSR has a value of O after reset and is unaffected by INIT# or SIPI#. 


If any one of the enumeration 
conditions for defined bit field 
positions holds. 


0 Indirect Branch Restricted Speculation (IBRS). Restricts speculation of If CPUID.(EAX=07H, 
indirect branch. ECX=0):EDX[26]=1 

1 Single Thread Indirect Branch Predictors (STIBP). Prevents indirect If CPUID.(EAX=07H, 
branch predictions on all logical processors on the core from being ECX=0):EDX[27]=1 
controlled by any sibling logical processor in the same core. 

2 Speculative Store Bypass Disable (SSBD) delays speculative execution of | If CPUID.(EAX=07H, 
a load until the addresses for all older stores are known. ECX=0):EDX[31]=1 

3 IPRED_DIS_U If CPUID.(EAX=07H, 
If 1, enables IPRED_DIS control for CPL3. ECX=2):€DX[1]=1 

4 IPRED_DIS_S If CPUID.(EAX=07H, 
If 1, enables IPRED_DIS control for CPLO/1/2. ECX=2):€DX[1]=1 

5 RRSBA_DIS_U If CPUID.(EAX=07H, 
If 1, disables RRSBA behavior for CPL3. ECX=2):€DX[2]-1 

6 RRSBA_DIS_S If CPUID.(EAX=07H, 
If 1, disables RRSBA behavior for CPLO/1/2. ECX=2):€DX[2]-1 

7 PSFD If CPUID.(EAX=07H, 
If 1, disables Fast Store Forwarding Predictor. Note that setting bit 2 ECX=2)-EDX[0]=1 
(SSBD) also disables this. 

8 DDPD_U If CPUID.(EAX=07H, 
If 1, disables the Data Dependent Prefetcher that examines data values ECX=2):EDX[3]=1 
in memory while CPL = 3. Note that setting bit 2 (SSBD) also disables 
this. 

9 Reserved. 

10 BHI_DIS_S If CPUID.(EAX=07H, 
When ‘1, enables BHI_DIS_S behavior. ECX=2):€DX[4]=1 

63:11 Reserved. 


Register Address: 49H, 73 


IA32_PRED_CMD 


Prediction Command (WO) 
Gives software a way to issue commands that affect the state of predictors. 


If any one of the enumeration 
conditions for defined bit field 
positions holds. 


0 


63:1 


Indirect Branch Prediction Barrier (IBPB) 


Reserved. 


If CPUID.(EAX=07H, 
ECX=0):EDX[26]=1 


Register Address: 4EH, 78 


IA32_PPIN_CTL 


Protected Processor Inventory Number Enable Control (R/W) 
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lf CPUID(EAX=07H, 
ECX=01H):EBX[0]=1! 


Table 2-2. IA-32 Architectural MSRs (Contd.) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description 


Comment 


0 LockOut (R/WO) 
If O, indicates that further writes to [A32_PPIN_CTL is allowed. 


If 1, indicates that further writes to [A32_PPIN_CTL is disallowed. 
Writing 1 to this bit is only permitted if the Enable_PPIN bit is clear. 
The Privileged System Software Inventory Agent should read 
1A32_PPIN_CTL[bit 1] to determine if |A32_PPIN is accessible. 


The Privileged System Software Inventory Agent is not expected to 
write to this MSR. 


1 Enable_PPIN (R/W) 
If 1, indicates that [A32_PPIN is accessible using RDMSR. 


If 0, indicates that [A32_PPIN is inaccessible using RDMSR. Any attempt 
to read IA32_PPIN will cause #GP. 


63:2 Reserved. 


Register Address: 4FH, 79 IA32_PPIN 


Protected Processor Inventory Number (R/O) 


63:0 Protected Processor Inventory Number (R/O) 


A unique value within a given CPUID family/model/stepping signature 
that a privileged inventory initialization agent can access to identify each 
physical processor, when access to |[A32_PPIN is enabled. Access to 
IA32_PPIN is permitted only if [A32_PPIN_CTL[bits 1:0] =‘10b’. 


If CPUID(EAX=07H, 
ECX=01H):EBX[0]=1! 


Register Address: 79H, 121 


IA32_BlOS_UPDT_TRIG (BIOS_UPDT_TRIG) 


BIOS Update Trigger (W) 


Executing a WRMSR instruction to this MSR causes a microcode update to be loaded into the 
processor. See Section 10.11.6, “Microcode Update Loader.” 


A processor may prevent writing to this MSR when loading guest states on VM entries or saving 
guest states on VM exits. 


06_01H 


Register Address: 7AH, 122 IA32_FEATURE_ACTIVATION 


Feature Activation (R/W) 


Implements Feature Activation command. WRMSR to this address activates all ‘activatable’ 
features on this thread. 


0 Reserved. 
1 KL 

Keylocker feature activation. 
63:2 Reserved. 


Register Address: 8BH, 139 


IA32_BlOS_SIGN_ID (BIOS_SIGN/BBL_CR_D3) 


BIOS Update Signature (R/W) 
Returns the microcode update signature following the execution of CPUID.O1H. 


A processor may prevent writing to this MSR when loading guest states on VM entries or saving 
guest states on VM exits. 


06_01H 


31:0 Reserved. 


Register Address: 8CH, 140 IA32_SGXLEPUBKEYHASHO 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description 


Comment 


IA32_SGXLEPUBKEYHASH[63:0] (R/W) 


Bits 63:0 of the SHA256 digest of the SIGSTRUCT.MODULUS for SGX Launch Enclave. On reset, 
the default value is the digest of Intel's signing key. 


Read permitted If 

CPUID.(EAX=1 2H,ECX=OH): 
EAX[O]=1 && CPUID.(EAX=07H, 
E€CX=0H):ECX[30]=1. 

Write permitted if 

CPUID.(EAX=1 2H,ECX=OH): 
EAX[O]=1 && 
IA32_FEATURE_CONTROL[1 7] = 1 
&& IA32_FEATURE_CONTROL[O] 
=1. 


Register Address: 8DH, 141 IA32_SGXLEPUBKEYHASH1 


IA32_SGXLEPUBKEYHASH{[1 27:64] (R/W) 


Bits 127:64 of the SHA256 digest of the SIGSTRUCT.MODULUS for SGX Launch Enclave. On reset, 
the default value is the digest of Intel's signing key. 


Same comment in MSR listing for 
IA32_SGXLEPUBKEYHASHO (MSR 
address 8CH, 140) applies here. 


Register Address: 8EH, 142 


IA32_SGXLEPUBKEYHASH2 


IA32_SGXLEPUBKEYHASH{[1 91:1 28] (R/W) 


Bits 191:128 of the SHA256 digest of the SIGSTRUCT.MODULUS for SGX Launch Enclave. On 
reset, the default value is the digest of Intel's signing key. 


Same comment in MSR listing for 
IA32_SGXLEPUBKEYHASHO (MSR 
address 8CH, 140) applies here. 


Register Address: 8FH, 143 


IA32_SGXLEPUBKEYHASH3 


IA32_SGXLEPUBKEYHASH[255:1 92] (R/W) 


Bits 255:192 of the SHA2Z56 digest of the SIGSTRUCT.MODULUS for SGX Launch Enclave. On 
reset, the default value is the digest of Intel's signing key. 


Same comment in MSR listing for 
IA32_SGXLEPUBKEYHASHO (MSR 
address 8CH, 140) applies here. 


Register Address: 9BH, 155 IA32_SMM_MONITOR_CTL 


SMM Monitor Configuration (R/W) 


If CPUID.O1H: ECX[5]=1 || 
CPUID.O1H: ECX[6] = 1 


0 Valid (R/W) 

1 Reserved. 

2 Controls SMI unblocking by VMXOFF (see Section 32.14.4). If IA32_VMX_MISC[28] 
11:3 Reserved. 

31:12 MSEG Base (R/W) 

63:32 Reserved. 


Register Address: 9EH, 158 IA32_SMBASE 


Base address of the logical processor's SMRAM image (R/O, SMM only). 


If IA32_VMX_MISC[15] 


Register Address: BCH, 188 IA32_MISC_PACKAGE_CTLS 


Power Filtering Control (R/W) 
This MSR has a value of O after reset and is unaffected by INIT# or SIPI#. 


If IA32_ARCH_CAPABILITIES 
[10] =1 


0 ENERGY_FILTERING_ENABLE (R/W) 
If set, RAPL MSRs report filtered processor power consumption data. 


This bit can be changed from O to 1, but cannot be changed from 1 to 0. 
After setting, all attempts to clear it are ignored until the next processor 
reset. 


If IA32_ARCH_CAPABILITIES 
[(W1]=1 


63:1 Reserved. 


2-8 Vol. 4 


Register Address: BDH, 189 IA32_XAPIC_DISABLE_STATUS 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description 


Comment 


xAPIC Disable Status (R/O) 


1 


If CPUID.(EAX-07H, 
ECX=0):EDX[29]=1 and 
IA32_ARCH_CAPABILITIES [21] = 


0 LEGACY_XAPIC_DISABLED 

When set, indicates that the local APIC is in x2APIC mode 

(IA32_APIC_BASE.EXTD = 1) and that attempts to clear 

1A32_APIC_BASE.EXTD will fail (e.g., WRMSR will #GP). 
63:1 Reserved. 
Register Address: C1H, 193 1A32_PMCO (PERFCTRO) 
General Performance Counter 0 (R/W) If CPUID.OAH: EAX[15:8] > 0 
Register Address: C2H, 194 1A32_PMC1 (PERFCTR1) 
General Performance Counter 1 (R/W) If CPUID.OAH: EAX[15:8] > 1 
Register Address: C3H, 195 IA32_PMC2 
General Performance Counter 2 (R/W) If CPUID.OAH: EAX[15:8] > 2 
Register Address: C4H, 196 IA32_PMC3 
General Performance Counter 3 (R/W) If CPUID.OAH: EAX[15:8] > 3 
Register Address: C5H, 197 IA32_PMC4 
General Performance Counter 4 (R/W) If CPUID.OAH: EAX[15:8] > 4 
Register Address: C6H, 198 IA32_PMC5 
General Performance Counter 5 (R/W) If CPUID.OAH: EAX[15:8] > 5 
Register Address: C7H, 199 IA32_PMC6 
General Performance Counter 6 (R/W) If CPUID.OAH: EAX[15:8] > 6 
Register Address: C8H, 200 IA32_PMC7 
General Performance Counter 7 (R/W) If CPUID.OAH: EAX[15:8] > 7 
Register Address: CFH, 207 IA32_CORE_CAPABILITIES 


|A32 Core Capabilities Register 


If CPUID.(EAX=07H, 
ECX=0):EDX[30] = 1 


63:0 Reserved. 


No architecturally defined bits. 


Register Address: €1H, 225 


IA32_UMWAIT_CONTROL 


UMWAIT Control (R/W) 


from this field and the lower two bits are zero. 


0 C0.2 is not allowed by the OS. Value of “1” means all CO.2 requests revert 
to C01. 

1 Reserved. 

31:2 Determines the maximum time in TSC-quanta that the processor can 


reside in either CO.1 or CO.2. A zero value indicates no maximum time. 
The maximum time value is a 32-bit value where the upper 30 bits come 


Register Address: E7H, 231 IA32_MPERF 


TSC Frequency Clock Counter (R/Write to clear) 


If CPUID.O6GH: 


ECX[O] = 1 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


63:0 


CO_MCNT: CO TSC Frequency Clock Count 


Increments at fixed interval (relative to TSC freq.) when the logical 
processor is in CO. 


Cleared upon overflow / wrap-around of IA32_APERF. 


Register Address: E8H, 232 


IA32_APERF 


Actual Performance Clock Counter (R/Write to clear) 


If CPUID.O6H: ECX[O] = 1 


63:0 


CO_ACNT: CO Actual Frequency Clock Count 


Accumulates core clock counts at the coordinated clock frequency, when 
the logical processor is in CO. 


Cleared upon overflow / wrap-around of [A32_MPERF. 


Register Address: FEH, 254 


IA32_MTRRCAP (MTRRcap) 


MTRR Capability (R/O) 


See Section 12.11.2.1, “IA32_MTRR_DEF_TYPE MSR.” 


06_01H 


7:0 VCNT: The number of variable memory type ranges in the processor. 
8 Fixed range MTRRs are supported when set. 

9 Reserved. 

10 WC Supported when set. 

11 SMRR Supported when set. 

12 PRMRR supported when set. 

63:13 Reserved. 


Register Address: 10AH, 266 


IA32_ARCH_CAPABILITIES 


Enumeration of Architectural Features (R/O) 


If CPUID.(EAX=07H, 
ECX=0):EDX[29]=1 


0 RDCL_NO: The processor is not susceptible to Rogue Data Cache Load 
(RDCL). 

1 IBRS_ALL: The processor supports enhanced IBRS. 

2 RSBA: The processor supports RSB Alternate. Alternative branch 
predictors may be used by RET instructions when the RSB is empty. SW 
using retpoline may be affected by this behavior. 

3 SKIP_L1DFL_VMENTRY: A value of 1 indicates the hypervisor need not 
flush the L1D on VM entry. 

4 SSB_NO: Processor is not susceptible to Speculative Store Bypass. 
MDS_NO: Processor is not susceptible to Microarchitectural Data 
Sampling (MDS). 

6 IF_PSCHANGE_MC_NO: The processor is not susceptible to a machine 
check error due to modifying the size of a code page without TLB 
invalidation. 

7 TSX_CTRL: If 1, indicates presence of IA32_TSX_CTRL MSR. 

8 TAA_NO: If 1, processor is not affected by TAA. 

9 MCU_CONTROL: If 1, the processor supports the [A32_MCU_CONTROL 


MSR. 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 

10 MISC_PACKAGE_CTLS: The processor supports 
IA32_MISC_PACKAGE_CTLS MSR. 

11 ENERGY_FILTERING_CTL: The processor supports setting and reading 
the [A32_MISC_PACKAGE_CTLS[0] (ENERGY_FILTERING_ENABLE) bit. 

12 DOITM: If 1, the processor supports Data Operand Independent Timing 
Mode. 

13 SBDR_SSDP_NO: The processor is not affected by either the Shared 
Buffers Data Read (SBDR) vulnerability or the Sideband Stale Data 
Propagator (SSDP). 

14 FBSDP_NO: The processor is not affected by the Fill Buffer Stale Data 
Propagator (FBSDP). 

15 PSDP_NO: The processor is not affected by vulnerabilities involving the 
Primary Stale Data Propagator (PSDP). 

16 Reserved. 

17 FB_CLEAR: If 1, the processor supports overwrite of fill buffer values as 
part of MD_CLEAR operations with the VERW instruction. 

18 FB_CLEAR_CTRL: If 1, the processor supports the [A32_MCU_OPT_CTRL 
MSR and allows software to set bit 3 of that MSR (FB_CLEAR_DIS). 

19 RRSBA: A value of 1 indicates the processor may have the RRSBA 
alternate prediction behavior, if not disabled by RRSBA_DIS_U or 
RRSBA_DIS_S. 

20 BHI_NO: A value of 1 indicates BHI_NO branch prediction behavior, 
regardless of the value of IA32_SPEC_CTRL[BHI_DIS_S] MSR bit. 

21 XAPIC_DISABLE_STATUS: Enumerates that the 


IA32_XAPIC_DISABLE_STATUS MSR exists, and that bit 0 specifies 
whether the legacy xAPIC is disabled and APIC state is locked to x2APIC. 


22 Reserved. 
23 OVERCLOCKING_STATUS: If set, the IA32_OVERCLOCKING_STATUS MSR 
exists. 
24 PBRSB_NO: If 1, the processor is not affected by issues related to Post- 
Barrier Return Stack Buffer Predictions. 
63:25 Reserved. 
Register Address: 10BH, 267 IA32_FLUSH_CMD 
Flush Command (WO) If any one of the enumeration 
Gives software a way to invalidate structures with finer granularity than other architectural conditions for defined bit field 
methods. positions holds. 
0 L1D_FLUSH: Writeback and invalidate the L1 data cache. If CPUID.(EAX=07H, 
ECX=0):EDX[28]=1 
63:1 Reserved. 
Register Address: 10FH, 271 IA32_TSX_FORCE_ABORT 
TSX Force Abort If CPUID.(EAX=07H, 


ECX=0):EDX[1 3]=1 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
0 RTM_FORCE_ABORT R/W, Default: 0 
If 1, all RTM transactions abort with EAX code 0. If CPUID.(EAX=07H,ECX=0): 


EDX[11]=1, bit O is always 1 and 
writes to change it are ignored. 


If SDV_ENABLE_RTM is 1, bit 0 is 
always O and writes to change it 


are ignored. 
1 TSX_CPUID_CLEAR R/W, Default: 0 
When set, CPUID.(EAX=07H,ECX=0):EBX[1 1]=0 and Can be set only if 
CPUID.(EAX=07H,ECX=0):EBX[4]=0. CPUID.(EAX=07H,ECX=0): 


EDX[11]=1 or if 
SDV_ENABLE_RTM is 1. 
2 SDV_ENABLE_RTM R/W, Default: 0 


When set, CPUID.(EAX=07H,ECX=0):EDX[11]=0 and the processor may __| If 0, can be set only if 
not force abort RTM. This unsupported mode should only be used for CPUID.(EAX=07H,ECX=0): 


software development and not for production usage. EDX[11]=1. 
63:3 Reserved. 
Register Address: 122H, 290 IA32_TSX_CTRL 
IA32_TSX_CTRL Thread scope. Not architecturally 
serializing. 


Available when 
CPUID.ARCH_CAP(EAX=7H, ECX = 
0):EDX[29] = 1 and 
IA32_ARCH_CAPABILITIES.bit 7 = 
1. 


0 RTM_DISABLE 
When set to 1, XBEGIN will always abort with EAX code 0. 
1 TSX_CPUID_CLEAR 
When set to 1, CPUID.O7H.EBX.RTM [bit 11] and CPUID.O7H.EBX.HLE [bit 
4] report 0. 
When set to 0 and the SKU supports TSX, these bits will return 1. 
63:2 Reserved. 
Register Address: 123H, 291 IA32_MCU_OPT_CTRL 
Microcode Update Option Control (R/W) If CPUID.(EAX=07H, 
ECX=0):EDX[9]=1 or 
IA32_ARCH_CAPABILITIES [18] = 
1 or IA32_ARCH_CAPABILITIES. 
FB_CLEAR_CTRL=1 
0 RNGDS_MITG_DIS (R/w) If CPUID.(EAX=07H, 
If 0 (default), SRBDS mitigation is enabled for RDRAND and RDSEED. ECX=0):EDX[9]=1 


If 1, SRBDS mitigation is disabled for RDRAND and RDSEED executed 
outside of Intel SGX enclaves. 


1 RTM_ALLOW Read/Write 
If O, XBEGIN will always abort with EAX code 0. Setting RTM_LOCKED prevents 
If 1, XBEGIN behavior depends on the value of writes to this bit. 


IA32_TSX_CTRL[RTM_DISABLE]. 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 

2 RTM_LOCKED Read-Only status bit. 
When 1, RTM_ALLOW is locked at zero, writes to RTM_ALLOW will be 
ignored. 

3 FB_CLEAR_DIS If IA32_ARCH_CAPABILITIES. 
If 1, prevents the VERW instruction from performing an FB_CLEAR FB_CLEAR_CTRL=1 
action. 

4 GDS_MITG_DIS 
If O, the Gather Data Sampling mitigation is enabled (patch load time 
default). 

If 1 on all threads for a given core, the Gather Data Sampling mitigation is 
disabled. 

5 GDS_MITG_LOCK 
If 0, not locked, and GDS_MITG_DIS is under OS control. 

If 1, locked and GDS_MITG_DIS is forced to O (writes are ignored). 

63:6 Reserved. 

Register Address: 174H, 372 IA32_SYSENTER_CS 

SYSENTER_CS_MSR (R/W) 06_01H 

15:0 CS Selector. 

31:16 Not used. Can be read and written. 

63:32 Not used. Writes ignored; reads 

return zero. 

Register Address: 175H, 373 IA32_SYSENTER_ESP 

SYSENTER_ESP_MSR (R/W) 06_01H 

Register Address: 176H, 374 IA32_SYSENTER_EIP 

SYSENTER_EIP_MSR (R/W) 06_01H 

Register Address: 179H, 377 1A32_MCG_CAP (MCG_CAP) 

Global Machine Check Capability (R/O) 06_01H 

7:0 Count: Number of reporting banks. 

8 MCG_CTL_P: |A32_MCG_CTL is present if this bit is set. 

9 MCG_EXT_P: Extended machine check state registers are present if this 
bit is set. 

10 MCP_CMCI_P: Support for corrected MC error event is present. 06_01H 

11 MCG_TES_P: Threshold-based error status register are present if this bit 
is set. 

15:12 Reserved. 

23:16 MCG_EXT_CNT: Number of extended machine check state registers 
present. 

24 MCG_SER_P: The processor supports software error recovery if this bit is 
set. 

25 Reserved. 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
26 MCG_ELOG_P: Indicates that the processor allows platform firmware to | O6_3EH 
be invoked when an error is detected so that it may provide additional 
platform specific information in an ACPI format “Generic Error Data 
Entry” that augments the data included in machine check bank registers. 
27 MCG_LMCE_P: Indicates that the processor supports extended state in | O06_3€H 
IA32_MCG_STATUS and associated MSR necessary to configure Local 
Machine Check Exception (LMCE). 
63:28 Reserved. 
Register Address: 17AH, 378 IA32_MCG_STATUS (MCG_STATUS) 
Global Machine Check Status (R/W) 06_01H 
0 RIPV. Restart IP valid. 06_01H 
1 EIPV. Error IP valid. 06_01H 
2 MCIP. Machine check in progress. 06_01H 
3 LMCE_S. If IA32_MCG_CAP.LMCE_P[27] =1 
63:4 Reserved. 


Register Address: 17BH, 379 
Global Machine Check Control (R/W) 


IA32_MCG_CTL (MCG_CTL) 


If IA32_MCG_CAP.CTL_P[8] =1 


Register Address: 180H—185H, 384—389 N/A 


Reserved 


Register Address: 186H, 390 


IA32_PERFEVTSELO (PERFEVTSELO) 


06_OEH2 


Performance Event Select Register 0 (R/W) 


If CPUID.OAH: EAX[15:8] > 0 


7:0 Event Select: Selects a performance event logic unit. 

15:8 UMask: Qualifies the microarchitectural condition to detect on the 
selected event logic. 

16 USR: Counts while in privilege level is not ring O. 

17 OS: Counts while in privilege level is ring 0. 

18 Edge: Enables edge detection if set. 

19 PC: Enables pin control. 

20 INT: Enables interrupt on counter overflow. 

21 AnyThread: When set to 1, it enables counting the associated event 
conditions occurring across all logical processors sharing a processor 
core. When set to 0, the counter only increments the associated event 
conditions occurring in the logical processor which programmed the MSR. 

22 EN: Enables the corresponding performance counter to commence 
counting when this bit is set. 

23 INV: Invert the CMASK. 

31:24 CMASK: When CMASK is not zero, the corresponding performance 
counter increments each cycle if the event count is greater than or equal 
to the CMASK. 

63:32 Reserved. 


Register Address: 187H, 391 


IA32_PERFEVTSEL1 (PERFEVTSEL1) 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit 


Description 


Comment 


Performance Event Select Register 1 (R/W) 


If CPUID.OAH: EAX[15:8] > 1 


Register Address: 188H, 392 


IA32_PERFEVTSEL2 


Performance Event Select Register 2 (R/W) 


If CPUID.OAH: EAX[15:8] > 2 


Register Address: 189H, 393 


IA32_PERFEVTSEL3 


Performance Event Select Register 3 (R/W) 


If CPUID.OAH: EAX[15:8] > 3 


Register Address: 18AH, 394 


IA32_PERFEVTSEL4 


Performance Event Select Register 4 (R/W) 


If CPUID.OAH: EAX[15:8] > 4 


Register Address: 18BH, 395 


IA32_PERFEVTSEL5S 


Performance Event Select Register 5 (R/W) 


If CPUID.OAH: EAX[15:8] > 5 


Register Address: 18CH, 396 


IA32_PERFEVTSEL6 


Performance Event Select Register 6 (R/W) 


If CPUID.OAH: EAX[15:8] > 6 


Register Address: 18DH, 397 


IA32_PERFEVTSEL7 


Performance Event Select Register 7 (R/W) 


If CPUID.OAH: EAX[15:8] > 7 


Register Address: 18AH—194H, 394—404 N/A 
Reserved. 06_0EH? 
Register Address: 195H, 405 IA32_OVERCLOCKING_STATUS 
Overclocking Status (R/O) 
IA32_ARCH_CAPABILITIES[bit 23] enumerates support for this MSR. 
0 Overclocking Utilized 
Indicates if specific forms of overclocking have been enabled on this boot 
or reset cycle: O indicates no, 1 indicates yes. 
1 Undervolt Protection 
Indicates if the “Dynamic OC Undervolt Protection” security feature is 
active: 0 indicates disabled, 1indicates enabled. 
2 Overclocking Secure Status 
Indicates that overclocking capabilities have been unlocked by BIOS, with 
or without overclocking: O indicates Not Secured, 1 indicates Secure. 
63:4 Reserved. 
Register Address: 196H—197H, 406—407 N/A 
Reserved. 06_0€H? 
Register Address: 198H, 408 IA32_PERF_STATUS 
Current Performance Status (R/O) OF_03H 
See Section 15.1.1, “Software Interface For Initiating Performance State Transitions.” 
15:0 Current Performance State Value. 
63:16 Reserved. 
Register Address: 199H, 409 IA32_PERF_CTL 
Performance Control MSR (R/W) OF_03H 


Software makes a request for a new Performance state (P-State) by writing this MSR. See 
Section 15.1.1, “Software Interface For Initiating Performance State Transitions.” 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
15:0 Target performance State Value. 
31:16 Reserved. 
32 Intel® Dynamic Acceleration Technology Engage (R/W) 06_OFH (Mobile only) 
When set to 1: Disengages Intel Dynamic Acceleration Technology. 
63:33 Reserved. 


Register Address: 19AH, 410 


IA32_CLOCK_MODULATION 


Clock Modulation Control (R/W) 
See Section 15.8.3, “Software Controlled Clock Modulation.” 


If CPUID.O1H:EDX[22] = 1 


0 Extended On-Demand Clock Modulation Duty Cycle. If CPUID.O6H:EAX[5] = 1 

3:1 On-Demand Clock Modulation Duty Cycle: Specific encoded values for If CPUID.O1H:EDX[22] = 1 
target duty cycle modulation. 

4 On-Demand Clock Modulation Enable: Set 1 to enable modulation. If CPUID.O1H:EDX[22] = 1 

63:5 Reserved. 


Register Address: 19BH, 411 


IA32_THERM_INTERRUPT 


Thermal Interrupt Control (R/W) 


Enables and disables the generation of an interrupt on temperature transitions detected with the 
processor's thermal sensors and thermal monitor. 


See Section 15.8.2, “Thermal Monitor.” 


If CPUID.O1H:EDX[22] = 1 


0 High-Temperature Interrupt Enable If CPUID.O1H:EDX[22] = 1 
1 Low-Temperature Interrupt Enable If CPUID.O1H:EDX[22] = 1 
2 PROCHOT# Interrupt Enable If CPUID.O1H:EDX[22] = 1 
3 FORCEPR# Interrupt Enable If CPUID.O1H:EDX[22] = 1 
4 Critical Temperature Interrupt Enable If CPUID.O1H:EDX[22] = 1 
75 Reserved. 

14:8 Threshold #1 Value If CPUID.O1H:EDX[22] = 1 
15 Threshold #1 Interrupt Enable If CPUID.O1H:EDX[22] = 1 
22:16 Threshold #2 Value If CPUID.O1H:EDX[22] = 1 
23 Threshold #2 Interrupt Enable If CPUID.O1H:EDX[22] = 1 
24 Power Limit Notification Enable If CPUID.O6H:EAX[4] = 1 
25 Hardware Feedback Notification Enable If CPUID.O6H:EAX[24] = 1 
63:26 Reserved. 


Register Address: 19CH, 412 


IA32_THERM_STATUS 


Thermal Status Information (R/O) 
Contains status information about the processor's thermal sensor and automatic thermal 


monitoring facilities. 


See Section 15.8.2, “Thermal Monitor.” 


If CPUID.O1H:EDX[22] = 1 


0 Thermal Status (R/O) If CPUID.O1H:EDX[22] = 1 
1 Thermal Status Log (R/W) If CPUID.O1H:EDX[22] = 1 
2 PROCHOT # or FORCEPR# event (R/O) If CPUID.O1H:EDX[22] = 1 


2-16 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 

Bit Fields MSR/Bit Description Comment 
3 PROCHOT # or FORCEPR# log (R/WCO) If CPUID.O1H:EDX[22] = 1 
4 Critical Temperature Status (R/O) If CPUID.O1H:EDX[22] = 1 
5 Critical Temperature Status log (R/WCO) If CPUID.O1H:EDX[22] = 1 
6 Thermal Threshold #1 Status (R/O) If CPUID.O1H:ECX[8] = 1 
7 Thermal Threshold #1 log (R/WCO) If CPUID.O1H:ECX[8] = 1 
8 Thermal Threshold #2 Status (R/O) If CPUID.O1H:ECX[8] = 1 
9 Thermal Threshold #2 log (R/WCO) If CPUID.O1H:ECX[8] = 1 
10 Power Limitation Status (R/O) If CPUID.OGH:EAX[4] = 1 
11 Power Limitation log (R/WCO) If CPUID.O6GH:EAX[4] = 1 
12 Current Limit Status (R/O) If CPUID.O6H:EAX[7] = 1 
13 Current Limit log (R/WCO) If CPUID.O6GH:EAX[7] = 1 
14 Cross Domain Limit Status (R/O) If CPUID.OGH:EAX[7] = 1 
15 Cross Domain Limit log (R/WCO) If CPUID.O6H:EAX[7] = 1 
22:16 Digital Readout (R/O) If CPUID.O6GH:EAX[0] = 1 
26:23 Reserved. 
30:27 Resolution in Degrees Celsius (R/O) If CPUID.O6H:EAX[0] = 1 
31 Reading Valid (R/O) If CPUID.O6H:EAX[0] = 1 
63:32 Reserved. 
Register Address: 1A0H, 416 1A32_MISC_ENABLE 


Enable Misc. Processor Features (R/W) 
Allows a variety of processor functions to be enabled and disabled. 


0 Fast-Strings Enable OF_OH 


When set, the fast-strings feature (for REP MOVS and REP STORS) is 
enabled (default). When clear, fast-strings are disabled. 


2:1 Reserved. 


Automatic Thermal Control Circuit Enable (R/W) OF_OH 


1 = Setting this bit enables the thermal control circuit (TCC) portion of 
the Intel Thermal Monitor feature. This allows the processor to 
automatically reduce power consumption in response to TCC 
activation. 

O= Disabled. 


Note: In some products clearing this bit might be ignored in critical 
thermal conditions, and TM1, TM2, and adaptive thermal throttling will 
still be activated. 


The default value of this field varies with product. See respective tables 
where default value is listed. 


6:4 Reserved. 


Performance Monitoring Available (R) OF_OH 
1 = Performance monitoring enabled. 
Q= Performance monitoring disabled. 


10:8 Reserved. 


Vol.4 2-17 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-2. IA-32 Architectural MSRs (Contd.) 
Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
11 Branch Trace Storage Unavailable (R/O) OF_OH 


1 = Processor doesn't support branch trace storage (BTS). 
O= _ BTSis supported. 


12 Processor Event Based Sampling (PEBS) Unavailable (R/O) O06_OFH 


1 =  PE€BS is not supported. 
O=  PEBS is supported. 


15:13 Reserved. 
16 Enhanced Intel SpeedStep Technology Enable (R/W) If CPUID.O1H: ECX[7] =1 


O= Enhanced Intel SpeedStep Technology disabled. 
1 =  €nhanced Intel SpeedStep Technology enabled. 


17 Reserved. 


18 ENABLE MONITOR FSM (R/W) OF_O3H 
When this bit is set to 0, the MONITOR feature flag is not set 
(CPUID.01H:ECX[bit 3] = 0). This indicates that MONITOR/MWAIT are not 
supported. 

Software attempts to execute MONITOR/MWAIT will cause HUD when 
this bit is 0. 

When this bit is set to 1 (default), MONITOR/MWAIT are supported 
(CPUID.O1H:ECX[bit 3] = 1). 

If the SSE3 feature flag ECX[O] is not set (CPUID.01H:ECX[bit 0] = 0), the 
OS must not attempt to alter this bit. BIOS must leave it in the default 
state. Writing this bit when the SSE3 feature flag is set to O may 
generate a #GP exception. 


21:19 Reserved. 

22 Limit CPUID Maxval (R/W) OF_03H 
When this bit is set to 1, CPUID.OOH returns a maximum value in 
EAX[7:0] of 2. 


BIOS should contain a setup question that allows users to specify when 
the installed OS does not support CPUID functions greater than 2. 
Before setting this bit, BIOS must execute the CPUID.OH and examine 
the maximum value returned in EAX[7:0]. If the maximum value is 
greater than 2, this bit is supported. 

Otherwise, this bit is not supported. Setting this bit when the maximum 
value is not greater than 2 may generate a #GP exception. 

Setting this bit may cause unexpected behavior in software that 
depends on the availability of CPUID leaves greater than 2. 


23 XxTPR Message Disable (R/W) If CPUID.O1H:ECX[14] = 1 
When set to 1, XTPR messages are disabled. xXTPR messages are optional 
messages that allow the processor to inform the chipset of its priority. 
63:24 Reserved. 


Note: Some older processors defined one of these bits as a disable for 
the execute-disable feature of paging. If a processor supports this bit, 
this information is provided in the model-specific tables. See Table 2-3 
for the definition of this bit. 


Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
Performance Energy Bias Hint (R/w) If CPUID.6H:ECX[3] = 1 
3:0 Power Policy Preference: 

O indicates preference to highest performance. 
15 indicates preference to maximize energy saving. 
63:4 Reserved. 


Register Address: 1B1H, 433 


IA32_PACKAGE_THERM_STATUS 


Package Thermal Status Information (R/O) 
Contains status information about the package's thermal sensor. 
See Section 15.9, “Package Level Thermal Management.” 


If CPUID.O6H: EAX[6] = 1 


Pkg Thermal Status (R/O) 


Pkg Thermal Status Log (R/W) 


Pkg PROCHOT # event. (R/O) 


Pkg PROCHOT # log. (R/WCO) 


Pkg Critical Temperature Status. (R/O) 


Pkg Critical Temperature Status Log. (R/WCO) 


Pkg Thermal Threshold #1 Status. (R/O) 


Pkg Thermal Threshold #1 Log. (R/WCO 


COIN! DMD] mW] BR} WwW] MN] —|} © 


) 
Pkg Thermal Threshold #2 Status. (R/O) 
9 Pkg Thermal Threshold #1 Log. (R/WCO) 


10 Pkg Power Limitation Status. (R/O) 

11 Pkg Power Limitation Log. (R/WCO) 

15:12 Reserved. 

22:16 Pkg Digital Readout. (R/O) 

25:23 Reserved. 

26 Hardware Feedback Interface Structure Change Status. If CPUID.O6H:EAX.[1 9] = 1 
63:27 Reserved. 


Register Address: 1B2H, 434 


IA32_PACKAGE_THERM_INTERRUPT 


Pkg Thermal Interrupt Control (R/W) 


Enables and disables the generation of an interrupt on temperature transitions detected with the 


package's thermal sensor. 
See Section 15.9, “Package Level Thermal Management.” 


If CPUID.O6GH: EAX[6] = 1 


0 Pkg High-Temperature Interrupt Enable. 
1 Pkg Low-Temperature Interrupt Enable. 
2 Pkg PROCHOT# Interrupt Enable. 

3 Reserved. 

4 Pkg Overheat Interrupt Enable. 

75 Reserved. 

14:8 Pkg Threshold #1 Value. 

15 Pkg Threshold #1 Interrupt Enable. 
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Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
22:16 Pkg Threshold #2 Value. 
23 Pkg Threshold #2 Interrupt Enable. 
24 Pkg Power Limit Notification Enable. 
25 Hardware Feedback Interrupt Enable. If CPUID.O6H:EAX.[19] = 1 
63:26 Reserved. 


Register Address: 1C4H, 452 


IA32_XFD 


Extended Feature Disable Control (R/W) 
Controls which XSAVE-enabled features are temporarily disabled. 
See Section 13.14 of the Intel® 64 and IA-32 Architectures Software Developer's Manual, 


Volume 1. 


If CPUID.(EAX=ODH,ECX=1): 
EAX[4] = 1 


Register Address: 1C5H, 453 


IA32_XFD_ERR 


Extended Feature Disable Error Code (R/W) 
Reports which XSAVE-enabled features caused a fault due to being disabled. 
See Section 13.14 of the Intel® 64 and IA-32 Architectures Software Developer's Manual, 


Volume 1. 


If CPUID.(EAX=ODH,ECX=1): 
EAX[4] = 1 


Register Address: 1D9H, 473 


IA32_DEBUGCTL (MSR_DEBUGCTLA, MSR_DEBUGCTLB) 


Trace/Profile Resource Control (R/W) O06_OEH 
0 LBR: Setting this bit to 1 enables the processor to record arunning trace | O6_01H 
of the most recent branches taken by the processor in the LBR stack. 
1 BTF: Setting this bit to 1 enables the processor to treat EFLAGS.TF as 06_01H 
single-step on branches instead of single-step on instructions. 
vd BLD: Enable OS bus-lock detection. See Section 18.3.1.6 of the Intel® 64 | If (CPUID.(EAX=07H, 
and IA-32 Architectures Software Developer's Manual, Volume 3B. ECX=0):ECX[24] = 1) 
5:3 Reserved. 
6 TR: Setting this bit to 1 enables branch trace messages to be sent. 06_OEH 
7 BTS: Setting this bit enables branch trace messages (BTMs) to be logged | O6_OEH 
in a BTS buffer. 
8 BTINT: When clear, BTMs are logged in a BTS buffer in circular fashion. | O6_OEH 
When this bit is set, an interrupt is generated by the BTS facility when 
the BTS buffer is full. 
9 1: BTS_OFF_OS: When set, BTS or BTM is skipped if CPL = 0. O06_OFH 
10 BTS_OFF_USR: When set, BTS or BTM is skipped if CPL > 0. 06_OFH 
11 FREEZE_LBRS_ON_PMI: When set, the LBR stack is frozen on a PMI If CPUID.O1H: ECX[15] = 1 && 
request. CPUID.OAH: EAX[7:0] > 1 
12 FREEZE_PERFMON_ON_PMI: When set, each ENABLE bit of the global If CPUID.O1H: ECX[15] = 1 && 
counter control MSR are frozen (address 38FH) on a PMI request. CPUID.OAH: EAX[7:0] > 1 
13 ENABLE_UNCORE_PMI: When set, enables the logical processor to 06_1AH 
receive and generate PMI on behalf of the uncore. 
14 FREEZE_WHILE_SMM: When set, freezes perfmon and trace messages If IA32_PERF_CAPABILITIES[1 2] 
while in SMM. =1 
15 RTM_DEBUG: When set, enables DR7 debug bit on XBEGIN. If (CPUID.(EAX=07H, 


ECX=0):EBX[1 1] = 1) 
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Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit 


Description 


Comment 


63:16 Reserved. 


Register Address: 1DDH, 477 


IA32_LER_FROM_IP 


Last Event Record Source IP Register (R/W) 


63:0 FROM_IP 


The source IP of the recorded branch or event, in canonical form. 


Reset Value: 0 


Register Address: 1DEH, 478 


IA32_LER_TO_IP 


Last Event Record Destination IP Register (R/W) 


63:0 TO_IP 


The destination IP of the recorded branch or event, in canonical form. 


Reset Value: 0 


Register Address: 1€0H, 480 


IA32_LER_INFO 


Last Event Record Info Register (R/W) 


55:0 Undefined, may be zero or non-zero. Writes of non- zero values do not | Reset Value: 0 
fault, but reads may return a different value. 

59:56 BR_TYPE Reset Value: 0 
The branch type recorded by this LBR. Encodings match those of 
IA32_LBR_x_INFO. 

60 Undefined, may be zero or non-zero. Writes of non- zero values do not | Reset Value: 0 
fault, but reads may return a different value. 

61 TSX_ABORT Reset Value: 0 
This LBR record is a TSX abort. On processors that do not support Intel® 
TSX (CPUID.O7H.EBX.HLE[bit 4]=0 and CPUID.O7H.EBX.RTM[bit 1 1]=0), 
this bit is undefined. 

62 IN_TSX Reset Value: 0 
This LBR record records a branch that retired during a TSX transaction. 
On processors that do not support Intel® TSX (CPUID.O7H.EBX.HLE[bit 
4]=0 and CPUID.O7H.EBX.RTM[bit 11]=0), this bit is undefined. 

63 MISPRED Reset Value: 0 
The recorded branch taken/not-taken resolution (for conditional 
branches) or target (for any indirect branch, including RETs) was 
mispredicted. 


Register Address: 1F2H, 498 


IA32_SMRR_PHYSBASE 


SMRR Base Address (Writeable only in SMM) 


Base address of SMM memory range. 


If IA32_MTRRCAP.SMRR{[1 1] = 1 


7:0 Type. Specifies memory type of the range. 
11:8 Reserved. 
31:12 PhysBase 
SMRR physical Base Address. 
63:32 Reserved. 


Register Address: 1F3H, 499 


IA32_SMRR_PHYSMASK 


SMRR Range Mask (Writeable only in SMM) 


Range Mask of SMM memory range. 


If IA32_MTRRCAP[SMRR] = 1 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
10:0 Reserved. 
11 Valid 
Enable range mask. 
31:12 PhysMask 
SMRR address range mask. 
63:32 Reserved. 


Register Address: 1F8H, 504 


IA32_PLATFORM_DCA_CAP 


DCA Capability (R) 


If CPUID.O1H: ECX[18] = 1 


Register Address: 1F9H, 505 


IA32_CPU_DCA_CAP 


If set, CPU supports Prefetch-Hint type. 


If CPUID.O1H: ECX[18] = 1 


Register Address: 1FAH, 506 


IA32_DCA_O_CAP 


DCA type O Status and Control register. 


If CPUID.O1H: ECX[18] = 1 


0 DCA_ACTIVE: Set by HW when DCA is fuse-enabled and no defeatures 
are Set. 

2:1 TRANSACTION 

6:3 DCA_TYPE 

10:7 DCA_QUEUE_SIZE 

12:11 Reserved. 

16:13 DCA_DELAY: Writes will update the register but have no HW side-effect. 

23:17 Reserved. 

24 Sw_BLOCK: SW can request DCA block by setting this bit. 

25 Reserved. 

26 HW_BLOCK: Set when DCA is blocked by HW (e.g., CRO.CD = 1). 

31:27 Reserved. 


Register Address: 200H, 512 


IA32_MTRR_PHYSBASEO (MTRRphys 


Base0) 


See Section 12.11.2.3, “Variable Range MTRRs.” 


If IA32_MTRRCAP[7:0] > O 


Register Address: 201H, 513 


IA32_MTRR_PHYSMASKO 


MTRRphysMaskO 


If IA32_MTRRCAP[7:0] > O 


Register Address: 202H, 514 


IA32_MTRR_PHYSBASE1 


MTRRphysBase1 


Register Address: 203H, 515 


IA32_MTRR_PHYSMASK1 


If IA32_MTRRCAP[7:0] > 1 


MTRRphysMask1 


If IA32_MTRRCAP[7:0] > 1 


Register Address: 204H, 516 


MTRRphysBase2 


IA32_MTRR_PHYSBASE2 


If IA32_MTRRCAP[7:0] > 2 


Register Address: 205H, 517 


IA32_MTRR_PHYSMASK2 


MTRRphysMask2 


If IA32_MTRRCAP[7:0] > 2 


Register Address: 206H, 518 


IA32_MTRR_PHYSBASE3 


MTRRphysBase3 


If IA32_MTRRCAP[7:0] > 3 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 
MTRRphysMask3 If IA32_MTRRCAP[7:0] > 3 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 
MTRRphysBase4 If IA32_MTRRCAP[7:0] > 4 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 
MTRRphysMask4 If IA32_MTRRCAP[7:0] > 4 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 
MTRRphysBase5 If IA32_MTRRCAP[7:0] > 5 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 
MTRRphysMask5 If IA32_MTRRCAP[7:0] > 5 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 
MTRRphysBase6 If IA32_MTRRCAP[7:0] > 6 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 
MTRRphysMask6 If IA32_MTRRCAP[7:0] > 6 
Register Address: 20EH, 526 IA32_MTRR_PHYSBASE7 
MTRRphysBase7 If IA32_MTRRCAP[7:0] > 7 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
MTRRphysMask7 If IA32_MTRRCAP[7:0] > 7 
Register Address: 210H, 528 IA32_MTRR_PHYSBASE8 
MTRRphysBase8 If IA32_MTRRCAP[7:0] > 8 
Register Address: 211H, 529 IA32_MTRR_PHYSMASK8 
MTRRphysMask8 If IA32_MTRRCAP[7:0] > 8 
Register Address: 212H, 530 IA32_MTRR_PHYSBASE9 
MTRRphysBase9 If IA32_MTRRCAP[7:0] > 9 
Register Address: 213H, 531 IA32_MTRR_PHYSMASK9 
MTRRphysMask9 If IA32_MTRRCAP[7:0] > 9 


Register Address: 250H, 592 


IA32_MTRR_FIX64K_O0000 


MTRRfix64K_O0000 


If CPUID.O1H: EDX.MTRR{[1 2] =1 


Register Address: 258H, 600 


IA32_MTRR_FIX16K_80000 


MTRRfix16K_80000 


If CPUID.O1H: EDX.MTRR{[1 2] =1 


Register Address: 259H, 601 


IA32_MTRR_FIX16K_A0000 


MTRRfix16K_AO000 


If CPUID.O1H: EDX.MTRR[1 2] =1 


Register Address: 268H, 616 


IA32_MTRR_FIX4K_COO00 (MTRRfix4K_COO00) 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


Register Address: 269H, 617 


IA32_MTRR_FIX4K_C8000 


If CPUID.O1H: EDX.MTRR[1 2] =1 


MTRRfix4K_C8000 


If CPUID.O1H: EDX.MTRR{[1 2] =1 


Register Address: 26AH, 618 


IA32_MTRR_FIX4K_DO000 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 

Bit Fields MSR/Bit Description Comment 
MTRRfix4K_DOOO0O If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 26BH, 619 IA32_MTRR_FIX4K_D8000 
MTRRfix4K_D8000 If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
MTRRfix4K_EOO00 If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
MTRRfix4K_E8000 If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
MTRRfix4K_FOOOO If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
MTRRfix4K_F8000. If CPUID.O1H: EDX.MTRR[1 2] =1 
Register Address: 277H, 631 IA32_PAT 
IA32_PAT (R/W) If CPUID.O1H: EDX.MTRR[16] =1 
2:0 PAO 
7:3 Reserved. 

10:8 PA1 

15:11 Reserved. 

18:16 PA2 

23:19 Reserved. 

26:24 PA3 

31:27 Reserved. 

34:32 PA4 

39:35 Reserved. 

42:40 PAS 

47:43 Reserved. 

50:48 PAG 

55:51 Reserved. 

58:56 PA7 

63:59 Reserved. 

Register Address: 280H, 640 IA32_MCO_CTL2 
MSR to enable/disable CMCI capability for bank O. (R/W) If IA32_MCG_CAP[10] = 1 && 
See Section 16.3.2.5, “IA32_MCi_CTL2 MSRs.” IA32_MCG_CAP[7:0] > 0 
14:0 Corrected error count threshold. 

29:15 Reserved. 

30 CMCI_EN 

63:31 Reserved. 

Register Address: 281H, 641 IA32_MC1_CTL2 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description Comment 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 1 


Register Address: 282H, 642 


IA32_MC2_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 2 


Register Address: 283H, 643 


IA32_MC3_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 3 


Register Address: 284H, 644 


IA32_MC4_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 4 


Register Address: 285H, 645 


IA32_MC5_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 5 


Register Address: 286H, 646 


1A32_MC6_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 6 


Register Address: 287H, 647 


1A32_MC7_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


Register Address: 288H, 648 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 7 


IA32_MC8_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 8 


Register Address: 289H, 649 


1A32_MC9_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 9 


Register Address: 28AH, 650 


IA32_MC10_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 10 


Register Address: 28BH, 651 


IA32_MC11_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 11 


Register Address: 28CH, 652 


IA32_MC12_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 12 


Register Address: 28DH, 653 


IA32_MC13_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 13 


Register Address: 28H, 654 


IA32_MC14_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


Register Address: 28FH, 655 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 14 


IA32_MC15_CTL2 
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Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 15 


Register Address: 290H, 656 


IA32_MC16_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 16 


Register Address: 291H, 657 


IA32_MC17_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 17 


Register Address: 292H, 658 


IA32_MC18_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 18 


Register Address: 293H, 659 


IA32_MC19_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 19 


Register Address: 294H, 660 


IA32_MC20_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 20 


Register Address: 295H, 661 


IA32_MC21_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


Register Address: 296H, 662 


IA32_MC22_CTL2 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 21 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 22 


Register Address: 297H, 663 


IA32_MC23_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 23 


Register Address: 298H, 664 


IA32_MC24_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 24 


Register Address: 299H, 665 


IA32_MC25_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 25 


Register Address: 29AH, 666 


IA32_MC26_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 26 


Register Address: 29BH, 667 


IA32_MC27_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 27 


Register Address: 29CH, 668 


IA32_MC28_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


Register Address: 29DH, 669 


IA32_MC29_CTL2 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 28 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 29 


Register Address: 29EH, 670 


IA32_MC30_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 30 


Register Address: 29FH, 671 


IA32_MC31_CTL2 


Same fields as IA32_MCO_CTL2. (R/W) 


If IA32_MCG_CAP[10] = 1 && 
IA32_MCG_CAP[7:0] > 31 


Register Address: 2FFH, 767 


IA32_MTRR_DEF_TYPE 


Register Address: 309H, 777 


IA32_FIXED_CTRO 


MTRRdefType (R/w) If CPUID.O1H: EDX.MTRR[1 2] =1 
2:0 Default Memory Type 

9:3 Reserved. 

10 Fixed Range MTRR Enable 

11 MTRR Enable 

63:12 Reserved. 


Fixed-Function Performance Counter O (R/W): Counts Instr_ 


Retired.Any. 


If CPUID.OAH: EDX[4:0] > 0 


Register Address: 30AH, 778 


Fixed-Function Performance Counter 1 (R/W): Counts CPU_! 


IA32_FIXED_CTR1 


CLK_Unhalted.Core. 


If CPUID.OAH: EDX[4:0] > 1 


Register Address: 30BH, 779 


IA32_FIXED_CTR2 


Fixed-Function Performance Counter 2 (R/W): Counts CPU_! 
Register Address: 345H, 837 


CLK_Unhalted.Ref. 


IA32_PERF_CAPABILITIES 


If CPUID.OAH: EDX[4:0] > 2 


Read Only MSR that enumerates the existence of performance monitoring features. (R/O) 


If CPUID.O1H: ECX[15] = 1 


5:0 LBR format 

6 PEBS Trap 

7 PEBSSaveArchRegs 

11:8 PEBS Record Format 

12 1: Freeze while SMM is supported. 

13 1: Full width of counter writable via [A32_A_PMCx. 

14 PEBS_BASELINE 

15 1: Performance metrics available. 

16 1: PEBS output will be written into the Intel PT trace stream. If CPUID.Ox7.0.EBX[25]=1 
63:17 Reserved. 


Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 


Fixed-Function Performance Counter Control (R/w) 


Counter increments while the results of ANDing respective enable bit in 
IA32_PERF_GLOBAL_CTRL with the corresponding OS or USR bits in this MSR is true. 


If CPUID.OAH: EAX[7:0] > 1 


0 ENO_OS: Enable Fixed Counter O to count while CPL = 0. 
1 ENO_Usr: Enable Fixed Counter O to count while CPL > 0. 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
2 AnyThr0: When set to 1, it enables counting the associated event If CPUID.OAH:EAX[7:0] > 2 && 
conditions occurring across all logical processors sharing a processor CPUID.OAH:EDX[1 5]=0 
core. When set to 0, the counter only increments the associated event 
conditions occurring in the logical processor which programmed the MSR. 
3 ENO_PMI: Enable PMI when fixed counter O overflows. 
4 EN1_OS: Enable Fixed Counter 1to count while CPL = 0. 
5 EN1_Usr: Enable Fixed Counter 1to count while CPL > 0. 
6 AnyThr1: When set to 1, it enables counting the associated event If CPUID.OAH:EAX[7:0] > 2 && 
conditions occurring across all logical processors sharing a processor CPUID.OAH:EDX[1 5]=0 
core. When set to 0, the counter only increments the associated event 
conditions occurring in the logical processor which programmed the MSR. 
7 €N1_PMI: Enable PMI when fixed counter 1 overflows. 
8 EN2_OS: Enable Fixed Counter 2 to count while CPL = 0. 
9 EN2_Usr: Enable Fixed Counter 2 to count while CPL > 0. 
10 AnyThr2: When set to 1, it enables counting the associated event If CPUID.OAH:EAX[7:0] > 2 && 
conditions occurring across all logical processors sharing a processor CPUID.OAH:EDX[1 5]=0 
core. When set to 0, the counter only increments the associated event 
conditions occurring in the logical processor which programmed the MSR. 
11 EN2_PMI: Enable PMI when fixed counter 2 overflows. 
12 EN3_OS: Enable Fixed Counter 3 to count while CPL = 0. 
13 €N3_Usr: Enable Fixed Counter 3 to count while CPL > 0. 
14 Reserved. 
15 EN3_PMI: Enable PMI when fixed counter 3 overflows. 
63:16 Reserved. 
Register Address: 38EH, 910 IA32_PERF_GLOBAL_STATUS 
Global Performance Counter Status (R/O) If CPUID.OAH: EAX[7:0] > 0 Il 
(CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1 && 
CPUID.(EAX=014H, ECX=0):ECX[0] 
= 1) 
0 Ovf_PMCO: Overflow status of [A32_PMCO. If CPUID.OAH: EAX[15:8] > 0 
1 Ovf_PMC1: Overflow status of [A32_PMC1. If CPUID.OAH: EAX[15:8] > 1 
2 Ovf_PMC2: Overflow status of [A32_PMC2. If CPUID.OAH: EAX[15:8] > 2 
3 Ovf_PMC3: Overflow status of [A32_PMC3. If CPUID.OAH: EAX[15:8] > 3 
n Ovf_PMCn: Overflow status of IA32_PMCn. If CPUID.OAH: EAX[15:8] > n 
31:n+1 Reserved. 
32 Ovf_FixedCtr0: Overflow status of [A32_FIXED_CTRO. If CPUID.OAH: EAX[7:0] > 1 
33 Ovf_FixedCtr1: Overflow status of [A32_FIXED_CTR1. If CPUID.OAH: EAX[7:0] > 1 
34 Ovf_FixedCtr2: Overflow status of [A32_FIXED_CTR2. If CPUID.OAH: EAX[7:0] > 1 
47:35 Reserved. 
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48 OVF_PERF_METRICS: If this bit is set, it indicates that PERF_METRIC 
counter has overflowed and a PMI is triggered; however, an overflow of 
fixed counter 3 should normally happen first. If this bit is clear no 
overflow occurred. 


54:49 Reserved. 
55 Trace_ToPA_PMI: A PMI occurred due to a ToPA entry memory buffer If CPUID.(EAX=07H, 
that was completely filled. ECX=0):EBX[25] = 1 && 
CPUID.(EAX=01 4H, ECX=0):ECX[0] 
=1 
57:56 Reserved. 
58 LBR_Frz. LBRs are frozen due to: If CPUID.OAH: EAX[7:0] > 3 


* 1A32_DEBUGCTL.FREEZE_LBR_ON_PMI=1. 
« The LBR stack overflowed. 
59 CTR_Frz. Performance counters in the core PMU are frozen due to: If CPUID.OAH: EAX[7:0] > 3 


* |A32_DEBUGCTL.FREEZE_PERFMON_ON_PMI=1. 
= One or more core PMU counters overflowed. 


60 ASCI: Data in the performance counters in the core PMU may include If CPUID.(EAX=07H, 
contributions from the direct or indirect operation Intel SGX to protect an | ECX=0):EBX[2] = 1 
enclave. 

61 Ovf_Uncore: Uncore counter overflow status. If CPUID.OAH: EAX[7:0] > 2 

62 OvfBuf: DS SAVE area Buffer overflow status. If CPUID.OAH: EAX[7:0] > O 

63 CondChad: Status bits of this register have changed. If CPUID.OAH: EAX[7:0] > O 

Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 

Global Performance Counter Control (R/w) If CPUID.OAH: EAX[7:0] > 0 


Counter increments while the result of ANDing the respective enable bit in this MSR with the 
corresponding OS or USR bits in the general-purpose or fixed counter control MSR is true. 


0 EN_PMCO If CPUID.OAH: EAX[15:8] > 0 

1 EN_PMC1 If CPUID.OAH: EAX[15:8] > 1 

2 EN_PMC2 If CPUID.OAH: EAX[15:8] > 2 

n EN_PMCn If CPUID.OAH: EAX[15:8] > n 

31:n+1 Reserved. 

32 EN_FIXED_CTRO If CPUID.OAH: EDX[4:0] > 0 

33 EN_FIXED_CTR1 If CPUID.OAH: EDX[4:0] > 1 

34 EN_FIXED_CTR2 If CPUID.OAH: EDX[4:0] > 2 

47:35 Reserved. 

48 EN_PERF_METRICS: If this bit is set and fixed counter 3 is effectively 

enabled, built-in performance metrics are enabled. 

63:49 Reserved. 

Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 

Global Performance Counter Overflow Control (R/W) If CPUID.OAH: EAX[7:0] > 0 && 
CPUID.OAH: EAX[7:0] <= 3 

0 Set 1 to Clear Ovf_PMCO bit. If CPUID.OAH: EAX[15:8] > 0 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 

1 Set 1 to Clear Ovf_PMC1 bit. If CPUID.OAH: EAX[15:8] > 1 

2 Set 1 to Clear Ovf_PMC2 bit. If CPUID.OAH: EAX[15:8] > 2 

n Set 1 to Clear Ovf_PMCn bit. If CPUID.OAH: EAX[15:8] > n 

31:n Reserved. 

32 Set 1 to Clear Ovf_FIXED_CTRO bit. If CPUID.OAH: EDX[4:0] > 0 

33 Set 1 to Clear Ovf_FIXED_CTR1 bit. If CPUID.OAH: EDX[4:0] > 1 

34 Set 1 to Clear Ovf_FIXED_CTR2 bit. If CPUID.OAH: EDX[4:0] > 2 

54:35 Reserved. 

55 Set 1 to Clear Trace_ToPA_PMI bit. If (CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1) && 
IA32_RTIT_CTL.ToPA = 1 

60:56 Reserved. 

61 Set 1 to Clear Ovf_Uncore bit. 06_2EH 

62 Set 1 to Clear OvfBuf bit. If CPUID.OAH: EAX[7:0] > 0 

63 Set 1 to clear CondChgd bit. If CPUID.OAH: EAX[7:0] > 0 


Register Address: 390H, 912 


IA32_PERF_GLOBAL_STATUS_RESET 


Global Performance Counter Overflow Reset Control (R/W) 


If CPUID.OAH: EAX[7:0] > 3 Il 
(CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1 && 
CPUID.(EAX=01 4H, ECX=0):ECX[0] 
= 1) 


0 Set 1 to Clear Ovf_PMCO bit. If CPUID.OAH: EAX[15:8] > 0 

1 Set 1 to Clear Ovf_PMC1 bit. If CPUID.OAH: EAX[15:8] > 1 

2 Set 1 to Clear Ovf_PMC2 bit. If CPUID.OAH: EAX[15:8] > 2 

n Set 1 to Clear Ovf_PMCn bit. If CPUID.OAH: EAX[15:8] > n 

31:n Reserved. 

32 Set 1 to Clear Ovf_FIXED_CTRO bit. If CPUID.OAH: EDX[4:0] > 0 

33 Set 1 to Clear Ovf_FIXED_CTR1 bit. If CPUID.OAH: EDX[4:0] > 1 

34 Set 1 to Clear Ovf_FIXED_CTR2 bit. If CPUID.OAH: EDX[4:0] > 2 

47:35 Reserved. 

48 RESET_OVF_PERF_METRICS: If this bit is set, it will clear the status bit in 

the IA32_PERF_GLOBAL_STATUS register for the PERF_METRICS 
counters. 

54:49 Reserved. 

55 Set 1 to Clear Trace_ToPA_PMI bit. If CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1 && 
CPUID.(EAX=014H, ECX=0):ECX[0] 
=1 

57:56 Reserved. 

58 Set 1 to Clear LBR_Frz bit. If CPUID.OAH: EAX[7:0] > 3 

59 Set 1 to Clear CTR_Frz bit. If CPUID.OAH: EAX[7:0] > 3 
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Architectural MSRs (Contd.) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
58 Set 1 to Clear ASCI bit. If CPUID.OAH: EAX[7:0] > 3 
61 Set 1 to Clear Ovf_Uncore bit. 06_2EH 
62 Set 1 to Clear OvfBuf bit. If CPUID.OAH: EAX[7:0] > 0 
63 Set 1 to clear CondChgd bit. If CPUID.OAH: EAX[7:0] > 0 


Register Address: 391H, 913 


IA32_PERF_GLOBAL_STATUS_SET 


Global Performance Counter Overflow Set Control (R/W) 


If CPUID.OAH: EAX[7:0] > 3 Il 
(CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1 && 
CPUID.(EAX=01 4H, ECX=0):ECX[0] 
- 1) 


0 Set 1 to cause Ovf_PMCO = 1. If CPUID.OAH: EAX[7:0] > 3 

1 Set 1 to cause Ovf_PMC1 = 1. If CPUID.OAH: EAX[15:8] > 1 

2 Set 1 to cause Ovf_PMC2 = 1. If CPUID.OAH: EAX[15:8] > 2 

n Set 1 to cause Ovf_PMCn = 1. If CPUID.OAH: EAX[15:8] > n 

31:n Reserved. 

32 Set 1 to cause Ovf_FIXED_CTRO = 1. If CPUID.OAH: EAX[7:0] > 3 

33 Set 1 to cause Ovf_FIXED_CTR1 = 1. If CPUID.OAH: EAX[7:0] > 3 

34 Set 1 to cause Ovf_FIXED_CTR2 = 1. If CPUID.OAH: EAX[7:0] > 3 

47:35 Reserved. 

48 SET_OVF_PERF_METRICS: If this bit is set, it will set the status bit in the 

IA32_PERF_GLOBAL_STATUS register for the PERF_METRICS counters. 

54:49 Reserved. 

55 Set 1 to cause Trace_ToPA_PMI = 1. If CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1 && 
CPUID.(EAX=01 4H, ECX=0):ECX[0] 
=1 

57:56 Reserved. 

58 Set 1 to cause LBR_Frz = 1. If CPUID.OAH: EAX[7:0] > 3 

59 Set 1 to cause CTR_Frz = 1. If CPUID.OAH: EAX[7:0] > 3 

58 Set 1 to cause ASCI = 1. If CPUID.OAH: EAX[7:0] > 3 

61 Set 1 to cause Ovf_Uncore = 1. If CPUID.OAH: EAX[7:0] > 3 

62 Set 1 to cause OvfBuf = 1. If CPUID.OAH: EAX[7:0] > 3 

63 Reserved. 


Register Address: 392H, 914 


IA32_PERF_GLOBAL_INUSE 


Indicator that core perf 


mon interface is in use. (R/O) 


If CPUID.OAH: EAX[7:0] > 3 


0 


IA32_PERFEVTSELO in use. 


IA32_PERFEVTSEL1 in use. 


If CPUID.OAH: EAX[15:8] > 1 


2 IA32_PERFEVTSEL2 in use. If CPUID.OAH: EAX[15:8] > 2 
n IA32_PERFEVTSELn in use. If CPUID.OAH: EAX[15:8] > n 
31:n+1 Reserved. 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
32 1A32_FIXED_CTRO in use. 
33 1A32_FIXED_CTR1 in use. 
34 1A32_FIXED_CTR2 in use. 
62:35 Reserved or model specific. 
63 PMI in use. 


Register Address: 3F1H, 1009 


IA32_PEBS_ENABLE 


PEBS Control (R/W) 


0 Enable PEBS on IA32_PMCO. 06_OFH 
31 Reserved or model specific. 

31:4 Reserved. 

35:32 Reserved or model specific. 

63:36 Reserved. 


Register Address: 400H, 1024 


1A32_MCO_CTL 


MCO_CTL 


If IA32_MCG_CAP.CNT >0O 


Register Address: 401H, 1025 


IA32_MCO_STATUS 


MCO_STATUS 


If IA32_MCG_CAP.CNT >0 


Register Address: 402H, 1026 


1A32_MCO_ADDR? 


MCO_ADDR 


If IA32_MCG_CAP.CNT >0 


Register Address: 403H, 1027 IA32_MCO_MISC 
MCO_MISC If [A32_MCG_CAP.CNT >0 
Register Address: 404H, 1028 IA32_MC1_CTL 


MC1_CTL 


If IA32_MCG_CAP.CNT >1 


Register Address: 405H, 1029 


IA32_MC1_STATUS 


MC1_STATUS 


If IA32_MCG_CAP.CNT >1 


Register Address: 406H, 1030 
MC1_ADDR 


IA32_MC1_ADDR* 


If IA32_MCG_CAP.CNT >1 


Register Address: 407H, 1031 IA32_MC1_MISC 
MC1_MISC If [A32_MCG_CAP.CNT >1 
Register Address: 408H, 1032 IA32_MC2_CTL 


MC2_CTL 


If IA32_MCG_CAP.CNT >2 


Register Address: 409H, 1033 


IA32_MC2_STATUS 


MC2_STATUS 


If IA32_MCG_CAP.CNT >2 


Register Address: 40AH, 1034 


1A32_MC2_ADDR} 


MC2_ADDR 


If IA32_MCG_CAP.CNT >2 


Register Address: 40BH, 1035 IA32_MC2_MISC 
MC2_MISC If IA32_MCG_CAP.CNT >2 
Register Address: 40CH, 1036 IA32_MC3_CTL 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit 


Description 


Comment 


MC3_CTL 


If IA32_MCG_CAP.CNT >3 


Register Address: 40DH, 1037 


IA32_MC3_STATUS 


MC3_STATUS 


If IA32_MCG_CAP.CNT >3 


Register Address: 40€H, 1038 


IA32_MC3_ADDR! 


MC3_ADDR 


If IA32_MCG_CAP.CNT >3 


Register Address: 40FH, 1039 IA32_MC3_MISC 
MC3_MISC If [A32_MCG_CAP.CNT >3 
Register Address: 410H, 1040 IA32_MC4_CTL 


MC4_CTL 


If IA32_MCG_CAP.CNT >4 


Register Address: 411H, 1041 


IA32_MC4_STATUS 


MC4_STATUS 


If IA32_MCG_CAP.CNT >4 


Register Address: 412H, 1042 


IA32_MC4_ADDR1 


MC4_ADDR 


If IA32_MCG_CAP.CNT >4 


Register Address: 413H, 1043 IA32_MC4_ MISC 
MC4_MISC If IA32_MCG_CAP.CNT >4 
Register Address: 414H, 1044 IA32_MC5_CTL 


MC5_CTL 


If IA32_MCG_CAP.CNT >5 


Register Address: 415H, 1045 


IA32_MC5_STATUS 


MC5_STATUS 


If IA32_MCG_CAP.CNT >5 


Register Address: 416H, 1046 


IA32_MC5_ADDR? 


MC5_ADDR 


If IA32_MCG_CAP.CNT >5 


Register Address: 417H, 1047 IA32_MC5_MISC 
MC5_MISC If IA32_MCG_CAP.CNT >5 
Register Address: 418H, 1048 IA32_MC6_CTL 


MC6_CTL 
Register Address: 419H, 1049 


IA32_MC6_STATUS 


If IA32_MCG_CAP.CNT >6 


MC6_STATUS 


If IA32_MCG_CAP.CNT >6 


Register Address: 41AH, 1050 


1A32_MC6_ADDR? 


MC6_ADDR 


If IA32_MCG_CAP.CNT >6 


Register Address: 41BH, 1051 IA32_MC6_MISC 
MC6_MISC If [A32_MCG_CAP.CNT >6 
Register Address: 41CH, 1052 IA32_MC7_CTL 


MC7_CTL 


If IA32_MCG_CAP.CNT >7 


Register Address: 41DH, 1053 
MC7_STATUS 


IA32_MC7_STATUS 


If IA32_MCG_CAP.CNT >7 


Register Address: 41€H, 1054 


|A32_MC7_ADDR? 


MC7_ADDR 


If IA32_MCG_CAP.CNT >7 
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Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 
Register Address: 41FH, 1055 IA32_MC7_MISC 
MC7_MISC If IA32_MCG_CAP.CNT >7 
Register Address: 420H, 1056 IA32_MC8_CTL 


MC8_CTL 


If IA32_MCG_CAP.CNT >8 


Register Address: 421H, 1057 


IA32_MC8_STATUS 


MC8_STATUS 


If IA32_MCG_CAP.CNT >8 


Register Address: 422H, 1058 


1A32_MC8_ADDR} 


MC8_ADDR 


If IA32_MCG_CAP.CNT >8 


Register Address: 423H, 1059 IA32_MC8_MISC 
MC8_MISC If IA32_MCG_CAP.CNT >8 
Register Address: 424H, 1060 IA32_MC9_CTL 


MC9_CTL 


If IA32_MCG_CAP.CNT >9 


Register Address: 425H, 1061 


IA32_MC9_STATUS 


MC9_STATUS 


If IA32_MCG_CAP.CNT >9 


Register Address: 426H, 1062 


1A32_MC9_ADDR! 


MC9_ADDR 


If IA32_MCG_CAP.CNT >9 


Register Address: 427H, 1063 


IA32_MC9_MISC 


MC9_MISC 


If IA32_MCG_CAP.CNT >9 


Register Address: 428H, 1064 


IA32_MC10_CTL 


MC10_CTL 


If IA32_MCG_CAP.CNT >10 


Register Address: 429H, 1065 


IA32_MC10_STATUS 


MC10_STATUS 


If IA32_MCG_CAP.CNT >10 


Register Address: 42AH, 1066 


1A32_MC10_ADDR? 


MC10_ADDR 


If IA32_MCG_CAP.CNT >10 


Register Address: 42BH, 1067 
MC10_MISC 


IA32_MC10_MISC 


If IA32_MCG_CAP.CNT >10 


Register Address: 42CH, 1068 


IA32_MC11_CTL 


MC11_CTL 


If IA32_MCG_CAP.CNT >11 


Register Address: 42DH, 1069 


IA32_MC11_STATUS 


MC11_STATUS 


If IA32_MCG_CAP.CNT >11 


Register Address: 42EH, 1070 


1A32_MC11_ADDR? 


MC11_ADDR 


If IA32_MCG_CAP.CNT >11 


Register Address: 42FH, 1071 


IA32_MC11_MISC 


MC11_MISC 
Register Address: 430H, 1072 


IA32_MC12_CTL 


If IA32_MCG_CAP.CNT >11 


MC12_CTL 


If IA32_MCG_CAP.CNT >12 


Register Address: 431H, 1073 
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MC12_STATUS 


If IA32_MCG_CAP.CNT >12 


Register Address: 432H, 1074 


1A32_MC12_ADDR! 


MC12_ADDR 


If IA32_MCG_CAP.CNT >12 


Register Address: 433H, 1075 


IA32_MC12_MISC 


MC12_MISC 


If IA32_MCG_CAP.CNT >12 


Register Address: 434H, 1076 


IA32_MC13_CTL 


MC13_CTL 


If IA32_MCG_CAP.CNT >13 


Register Address: 435H, 1077 


IA32_MC13_STATUS 


MC13_STATUS 


If IA32_MCG_CAP.CNT >13 


Register Address: 436H, 1078 


1A32_MC13_ADDR! 


MC13_ADDR 


If IA32_MCG_CAP.CNT >13 


Register Address: 437H, 1079 


IA32_MC13_MISC 


MC13_MISC 


If IA32_MCG_CAP.CNT >13 


Register Address: 438H, 1080 


IA32_MC14_CTL 


MC14_CTL 


If IA32_MCG_CAP.CNT >14 


Register Address: 439H, 1081 


IA32_MC14_STATUS 


MC14_STATUS 


If IA32_MCG_CAP.CNT >14 


Register Address: 43AH, 1082 


1A32_MC14_ADDR! 


MC14_ADDR 


If IA32_MCG_CAP.CNT >14 


Register Address: 43BH, 1083 


IA32_MC14_MISC 


MC14_MISC 


If IA32_MCG_CAP.CNT >14 


Register Address: 43CH, 1084 


IA32_MC15_CTL 


MC15_CTL 


If IA32_MCG_CAP.CNT >15 


Register Address: 43DH, 1085 


IA32_MC15_STATUS 


MC15_STATUS 
Register Address: 43E€H, 1086 


1A32_MC15_ADDR! 


If IA32_MCG_CAP.CNT >15 


MC15_ADDR 


If IA32_MCG_CAP.CNT >15 


Register Address: 43FH, 1087 


IA32_MC15_MISC 


MC15_MISC 


If IA32_MCG_CAP.CNT >15 


Register Address: 440H, 1088 


IA32_MC16_CTL 


MC16_CTL 


If IA32_MCG_CAP.CNT >16 


Register Address: 441H, 1089 


IA32_MC16_STATUS 


MC16_STATUS 


If IA32_MCG_CAP.CNT >16 


Register Address: 442H, 1090 
MC16_ADDR 


1A32_MC16_ADDR? 


If IA32_MCG_CAP.CNT >16 


Register Address: 443H, 1091 


IA32_MC16_MISC 


MC16_MISC 


If IA32_MCG_CAP.CNT >16 
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Register Address: 444H, 1092 


IA32_MC17_CTL 


MC17_CTL 


If IA32_MCG_CAP.CNT >17 


Register Address: 445H, 1093 


IA32_MC17_STATUS 


MC17_STATUS 


If IA32_MCG_CAP.CNT >17 


Register Address: 446H, 1094 


1A32_MC17_ADDR? 


MC17_ADDR 


If IA32_MCG_CAP.CNT >17 


Register Address: 447H, 1095 


IA32_MC17_MISC 


MC17_MISC 


If IA32_MCG_CAP.CNT >17 


Register Address: 448H, 1096 


IA32_MC18_CTL 


MC18_CTL 


If IA32_MCG_CAP.CNT >18 


Register Address: 449H, 1097 


IA32_MC18_STATUS 


MC18_STATUS 


If IA32_MCG_CAP.CNT >18 


Register Address: 44AH, 1098 


1A32_MC18_ADDR} 


MC18_ADDR 


If IA32_MCG_CAP.CNT >18 


Register Address: 44BH, 1099 


IA32_MC18_MISC 


MC18_MISC 


If IA32_MCG_CAP.CNT >18 


Register Address: 44CH, 1100 


IA32_MC19_CTL 


MC19_CTL 


If IA32_MCG_CAP.CNT >19 


Register Address: 44DH, 1101 


IA32_MC19_STATUS 


MC19_STATUS 


If IA32_MCG_CAP.CNT >19 


Register Address: 44€H, 1102 


1A32_MC19_ADDR} 


MC19_ADDR 


If IA32_MCG_CAP.CNT >19 


Register Address: 44FH, 1103 


IA32_MC19_MISC 


MC19_MISC 


If IA32_MCG_CAP.CNT >19 


Register Address: 450H, 1104 
MC20_CTL 


IA32_MC20_CTL 


If IA32_MCG_CAP.CNT >20 


Register Address: 451H, 1105 


IA32_MC20_STATUS 


MC20_STATUS 


If IA32_MCG_CAP.CNT >20 


Register Address: 452H, 11061106 


1A32_MC20_ADDR} 


MC20_ADDR 


If IA32_MCG_CAP.CNT >20 


Register Address: 453H, 1107 


IA32_MC20_MISC 


MC20_MISC 


If IA32_MCG_CAP.CNT >20 


Register Address: 454H, 1108 


IA32_MC21_CTL 


MC21_CTL 
Register Address: 455H, 1109 


IA32_MC21_STATUS 


If IA32_MCG_CAP.CNT >21 


MC21_STATUS 


If IA32_MCG_CAP.CNT >21 


Register Address: 456H, 1110 
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MC21_ADDR 


If IA32_MCG_CAP.CNT >21 


Register Address: 457H, 1111 


IA32_MC21_MISC 


MC21_MISC 


If IA32_MCG_CAP.CNT >21 


Register Address: 458H, 1112 


IA32_MC22_CTL 


MC22_CTL 


If IA32_MCG_CAP.CNT >22 


Register Address: 459H, 1113 


IA32_MC22_STATUS 


MC22_STATUS 


If IA32_MCG_CAP.CNT >22 


Register Address: 45AH, 1114 


1A32_MC22_ADDR} 


MC22_ADDR 


If IA32_MCG_CAP.CNT >22 


Register Address: 45BH, 1115 


IA32_MC22_MISC 


MC22_MISC 


If IA32_MCG_CAP.CNT >22 


Register Address: 45CH, 1116 


IA32_MC23_CTL 


MC23_CTL 


If IA32_MCG_CAP.CNT >23 


Register Address: 45DH, 1117 


IA32_MC23_STATUS 


MC23_STATUS 


If IA32_MCG_CAP.CNT >23 


Register Address: 45€H, 1118 


1A32_MC23_ADDR! 


MC23_ADDR 


If IA32_MCG_CAP.CNT >23 


Register Address: 45FH, 1119 


IA32_MC23_MISC 


MC23_MISC 


If IA32_MCG_CAP.CNT >23 


Register Address: 460H, 1120 


IA32_MC24_ CTL 


MC24_CTL 


If IA32_MCG_CAP.CNT >24 


Register Address: 461H, 1121 


IA32_MC24_ STATUS 


MC24_STATUS 


If IA32_MCG_CAP.CNT >24 


Register Address: 462H, 1122 


1A32_MC24_ADDR} 


MC24_ADDR 
Register Address: 463H, 1123 


IA32_MC24_ MISC 


If IA32_MCG_CAP.CNT >24 


MC24_MISC 


If IA32_MCG_CAP.CNT >24 


Register Address: 464H, 1124 


IA32_MC25_CTL 


MC25_CTL 


If IA32_MCG_CAP.CNT >25 


Register Address: 465H, 1125 


IA32_MC25_STATUS 


MC25_STATUS 


If IA32_MCG_CAP.CNT >25 


Register Address: 466H, 1126 


1A32_MC25_ADDR! 


MC25_ADDR 


If IA32_MCG_CAP.CNT >25 


Register Address: 467H, 1127 
MC25_MISC 


IA32_MC25_MISC 


If IA32_MCG_CAP.CNT >25 


Register Address: 468H, 1128 


IA32_MC26_CTL 


MC26_CTL 


If IA32_MCG_CAP.CNT >26 
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Register Address: 469H, 1129 


IA32_MC26_STATUS 


MC26_STATUS 


If IA32_MCG_CAP.CNT >26 


Register Address: 46AH, 1130 


1A32_MC26_ADDR? 


MC26_ADDR 


If IA32_MCG_CAP.CNT >26 


Register Address: 46BH, 1131 


IA32_MC26_MISC 


MC26_MISC 


If IA32_MCG_CAP.CNT >26 


Register Address: 46CH, 1132 


IA32_MC27_CTL 


MC27_CTL 


If IA32_MCG_CAP.CNT >27 


Register Address: 46DH, 1133 


IA32_MC27_STATUS 


MC27_STATUS 


If IA32_MCG_CAP.CNT >27 


Register Address: 46EH, 1134 


1A32_MC27_ADDR} 


MC27_ADDR 


If IA32_MCG_CAP.CNT >27 


Register Address: 46FH, 1135 


IA32_MC27_MISC 


MC27_MISC 


If IA32_MCG_CAP.CNT >27 


Register Address: 470H, 1136 


IA32_MC28_CTL 


MC28_CTL 


If IA32_MCG_CAP.CNT >28 


Register Address: 471H, 1137 


IA32_MC28_STATUS 


MC28_STATUS 


If IA32_MCG_CAP.CNT >28 


Register Address: 472H, 1138 


1A32_MC28_ADDR? 


MC28_ADDR 


If IA32_MCG_CAP.CNT >28 


Register Address: 473H, 1139 


IA32_MC28_MISC 


MC28_MISC 


If IA32_MCG_CAP.CNT >28 


Register Address: 474H, 1140 


IA32_MC29_CTL 


MC29_CTL 


If IA32_MCG_CAP.CNT >29 


Register Address: 475H, 1141 
MC29_STATUS 


IA32_MC29_STATUS 


If IA32_MCG_CAP.CNT >29 


Register Address: 476H, 1142 


IA32_MC29_ADDR 


MC29_ADDR 


If IA32_MCG_CAP.CNT >29 


Register Address: 477H, 1143 


IA32_MC29_MISC 


MC29_MISC 


If IA32_MCG_CAP.CNT >29 


Register Address: 478H, 1144 


IA32_MC30_CTL 


MC30_CTL 


If IA32_MCG_CAP.CNT >30 


Register Address: 479H, 1145 


IA32_MC30_STATUS 


MC30_STATUS 
Register Address: 47AH, 1146 


IA32_MC30_ADDR 


If IA32_MCG_CAP.CNT >30 


MC30_ADDR 


If IA32_MCG_CAP.CNT >30 


Register Address: 47BH, 1147 
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MC30_MISC If IA32_MCG_CAP.CNT >30 
Register Address: 47CH, 1148 IA32_MC31_CTL 
(es al If [A32_MCG_CAP.CNT >31 


Register Address: 47DH, 1149 


IA32_MC31_STATUS 


MC31_STATUS 


If IA32_MCG_CAP.CNT >31 


Register Address: 47EH, 1150 


IA32_MC31_ADDR 


MC31_ADDR If IA32_MCG_CAP.CNT >31 
Register Address: 47FH, 1151 IA32_MC31_MISC 
MC31_MISC If IA32_MCG_CAP.CNT >31 


Register Address: 480H, 1152 


IA32_VMX_BASIC 


Reporting Register of Basic VMX Capabilities (R/O) 
See Appendix A.1, “Basic VMX Information.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 481H, 1153 


IA32_WMX_PINBASED_CTLS 


See Appendix A.3.1, “Pin-Based VM-Execution Controls.” 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 482H, 1154 


IA32_WMX_PROCBASED_CTLS 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) 
See Appendix A.3.2, “Primary Processor-Based VM-Execution Controls.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 483H, 1155 


IA32_VMX_EXIT_CTLS 


Capability Reporting Register of Primary VM-Exit Controls ( 
See Appendix A.4.1, “Primary VM-Exit Controls.” 


R/O) 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 484H, 1156 


IA32_VMX_ENTRY_CTLS 


Capability Reporting Register of VM-Entry Controls (R/O) 
See Appendix A.5, “VM-Entry Controls.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 485H, 1157 


IA32_WVMX_MISC 


Reporting Register of Miscellaneous VMX Capabilities (R/O) 
See Appendix A.6, “Miscellaneous Data.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 486H, 1158 


IA32_VMX_CRO_FIXEDO 


Capability Reporting Register of CRO Bits Fixed to O (R/O) 
See Appendix A.7, “VMX-Fixed Bits in CRO.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 487H, 1159 


IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO Bits Fixed to 1 (R/O) 
See Appendix A.7, “VMX-Fixed Bits in CRO.” 


If CPUID.O1H:ECX.[5] = 1 


Register Address: 488H, 1160 


IA32_WMX_CR4_FIXEDO 


Capability Reporting Register of CR4 Bits Fixed to O (R/O) 
See Appendix A.8, “VMX-Fixed Bits in CR4.” 


If CPUID.O1H:ECX.[5] = 1 


Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) 


See Appendix A.8, “VMX-Fixed Bits in CR4.” 


Register Address: 489H, 1161 IA32_VMX_CR4_FIX€D1 


If CPUID.O1H:ECX.[5] = 1 
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Register Address: 48AH, 1162 IA32_VMX_VMCS_ENUM 

Capability Reporting Register of VMCS Field Enumeration (R/O) If CPUID.O1H:ECX.[5] = 1 

See Appendix A.9, “VMCS Enumeration.” 

Register Address: 48BH, 1163 IA32_VMX_PROCBASED_CTLS2 

Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) If (CPUID.O1H:ECX.[5] && 

See Appendix A.3.3, “Secondary Processor-Based VM-Execution Controls.”  aiciiiaiiiireni 

Register Address: 48CH, 1164 IA32_VMX_EPT_VPID_CAP 

Capability Reporting Register of EPT and VPID (R/O) If ( CPUID.O1H:ECX.[5] && 

See Appendix A.10, “VPID and EPT Capabilities.” Ce 
1A32_VMX_PROCBASED_CTLS2[3 
eae eRecaMer wees 
7))) 

Register Address: 48DH, 1165 IA32_VMX_TRUE_PINBASED_CTLS 

Capability Reporting Register of Pin-Based VM-Execution Flex Controls (R/O) If ( CPUID.O1H:ECX.[5] && 

See Appendix A.3.1, “Pin-Based VM-Execution Controls.” IA32_VMX_BASIC[S5] ) 

Register Address: 48€H, 1166 IA32_VMX_TRUE_PROCBASED_CTLS 

Capability Reporting Register of Primary Processor-Based VM-Execution Flex Controls (R/O) If( CPUID.O1H:ECX [5] && 

See Appendix A.3.2, “Primary Processor-Based VM-Execution Controls.” IA32_VMX_BASIC[S5] ) 

Register Address: 48FH, 1167 IA32_VMX_TRUE_EXIT_CTLS 

Capability Reporting Register of VM-Exit Flex Controls (R/O) If( CPUID.O1H:ECX [5] && 

See Appendix A.4, “VM-Exit Controls.” IA32_VMX_BASIC[S5] ) 

Register Address: 490H, 1168 IA32_VMX_TRUE_ENTRY_CTLS 

Capability Reporting Register of VM-Entry Flex Controls (R/O) If( CPUID.O1H:ECX [5] && 

See Appendix A.5, “VM-Entry Controls.” IA32_WVMX_BASIC[S5] ) 

Register Address: 491H, 1169 IA32_VMX_VMFUNC 

Capability Reporting Register of VM-Function Controls (R/O) If( CPUID.O1H:ECX [5] && 
1A32_VMX_PROCBASED_CTLS[63 
ie aaecnRoCene wiceaiA 
5]) 

Register Address: 492H, 1170 IA32_VMX_PROCBASED_CTLS3 

Capability Reporting Register of Tertiary Processor-Based VM-Execution Controls (R/O) If (CPUID.O1H:ECX.[5] && 

See Appendix A.3.4, “Tertiary Processor-Based VM-Execution Controls.” a hia ai 

Register Address: 493H, 1171 IA32_VMX_EXIT_CTLS2 

Capability Reporting Register of Secondary VM-Exit Controls (R/O) If ( CPUID.O1H:ECX.[5] && 

See Appendix A.4.2, “Secondary VM-Exit Controls.” IA32_VMX_EXIT_CTLS[63]) 

Register Address: 4C1H, 1217 IA32_A_PMCO 

Full Width Writable IA32_PMCO Alias (R/W) (If CPUID.OAH: EAX[15:8] > 0) && 
IA32_PERF_CAPABILITIES[1 3] = 1 
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Register Address: 4C2H, 1218 1A32_A_PMC1 

Full Width Writable [A32_PMC1 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 1) && 
IA32_PERF_CAPABILITIES[1 3] = 1 

Register Address: 4C3H, 1219 IA32_A_PMC2 

Full Width Writable IA32_PMC2 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 2) && 
IA32_PERF_CAPABILITIES[1 3] = 1 

Register Address: 4C4H, 1220 IA32_A_PMC3 

Full Width Writable [A32_PMC3 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 3) && 
IA32_PERF_CAPABILITIES[13] = 1 

Register Address: 4C5H, 1221 lA32_A_PMC4 

Full Width Writable [A32_PMC4 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 4) && 
IA32_PERF_CAPABILITIES[1 3] = 1 

Register Address: 4C6H, 1222 IA32_A_PMC5 

Full Width Writable IA32_PMC5 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 5) && 
IA32_PERF_CAPABILITIES[1 3] = 1 

Register Address: 4C7H, 1223 IA32_A_PMC6 

Full Width Writable IA32_PMC6 Alias (R/W) (If CPUID.OAH: EAX[15:8] > 6) && 
IA32_PERF_CAPABILITIES[1 3] = 1 

Register Address: 4C8H, 1224 IA32_A_PMC7 


Full Width Writable IA32_PMC7 Alias (R/W) 


(If CPUID.OAH: EAX[15:8] > 7) && 
IA32_PERF_CAPABILITIES[1 3] = 1 


Register Address: 4DOH, 1232 


IA32_MCG_EXT_CTL 


Allows software to signal some MCEs to only a single logical processor in the system. (R/W) 


See Section 16.3.1.4, “IA32_MCG_EXT_CTL MSR.” 


If IA32_MCG_CAP.LMCE_P =1 


0 LMCE_EN 


63:1 Reserved. 


Register Address: 500H, 1280 IA32_SGX_SVN_STATUS 


Status and SVN Threshold of SGX Support for ACM (R/O) 


If CPUID.(EAX=07H, ECX=OH): 
EBX[2] = 1 


0 Lock. See Section 39.11.3, “Interactions 
with Authenticated Code Modules 
(ACMs).” 

15:1 Reserved. 

23:16 SGX_SVN_SINIT See Section 39.11.3, “Interactions 
with Authenticated Code Modules 
(ACMs).” 

63:24 Reserved. 


Register Address: 560H, 1376 


IA32_RTIT_OUTPUT_BASE 
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Trace Output Base Register (R/W) If ((CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1) && ( 
(CPUID.(EAX=14H,ECX=0):ECX[0] 
=1)Il 
(CPUID.(EAX=14H,ECX=0):ECX[2] 
=1))) 

6:0 Reserved. 

MAXPHYADDR4-1:7 Base physical address. 

63:MAXPHYADDR Reserved. 

Register Address: 561H, 1377 IA32_RTIT_OUTPUT_MASK_PTRS 

Trace Output Mask Pointers Register (R/W) If ((CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1) && ( 
(CPUID.(EAX=1 4H,ECX=0):€CX[0] 
=1)Il 
(CPUID.(EAX=14H,ECX=0):ECX[2] 
=1))) 

6:0 Reserved. 

31:7 MaskOrTableOffset. 

63:32 Output Offset. 

Register Address: 570H, 1392 IA32_RTIT_CTL 


Trace Control Register (R/W) 


If (CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1) 


0 TraceEn 

1 CYCEn If (CPUID.(EAX=07H, 
ECX=0):EBX[1] = 1) 

2 OS 

User 

4 Pwr€vtEn If (CPUID.(EAX=07H, 
ECX=1):EBX[5] = 1) 

5 FUPonPTW If (CPUID.(EAX=07H, 
ECX=1):EBX[4] = 1) 

6 FabricEn If (CPUID.(EAX=07H, 
ECX=0):ECX[3] = 1) 

7 CR3Filter If (CPUID.(EAX=14H, 
ECX=0):EBX[0] = 1) 

8 ToPA 

9 MTCEn If (CPUID.(EAX=07H, 
ECX=0):EBX[3] = 1) 

10 TSCEn 

11 DisRETC 

12 PTWEn If (CPUID.(EAX=07H, 
ECX=1):EBX[4] = 1) 

13 BranchEn 
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17:14 MTCFreq. If (CPUID.(EAX=07H, 
ECX=0):EBX[3] = 1) 

18 Reserved, must be zero. 

22:19 CycThresh If (CPUID.(EAX=07H, 
ECX=0):EBX[1] = 1) 

23 Reserved, must be zero. 

27:24 PSBFreq If (CPUID.(EAX=07H, 
ECX=0):EBX[1] = 1) 

30:28 Reserved, must be zero. 

31 EventEn If (CPUID.(EAX=14H, 
ECX=0):EBX[7] = 1) 

35:32 ADDRO_CFG If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 0) 

39:36 ADDR1_CFG If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 1) 

43:40 ADDR2_CFG If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 2) 

47:44 ADDR3_CFG If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 3) 

54:48 Reserved, must be zero. 

55 DisTNT If (CPUID.(EAX=14H, 
ECX=0):EBX[8] = 1) 

56 InjectPsbPmiOnEnable If (CPUID.(EAX=07H, 
ECX=1):EBX[6] = 1) 

63:57 Reserved, must be zero. 


Register Address: 571H, 1393 


IA32_RTIT_STATUS 


Tracing Status Register (R/W) 


If (CPUID(EAX=07H, 
ECX=0):EBX[25] = 1) 


0 FilterEn (writes ignored). If (CPUID.(EAX=07H, 
ECX=0):EBX[2] = 1) 

1 ContexEn (writes ignored). 

2 TriggerEn (writes ignored). 

3 Reserved. 

4 Error 

5 Stopped 

6 PendPSB If (CPUID.(EAX=07H, 
ECX=0):EBX[6] = 1) 

7 PendToPAPMI If (CPUID.(EAX=07H, 
ECX=0):EBX[6] = 1) 

31:8 Reserved, must be zero. 

48:32 PacketByteCnt If (CPUID.(EAX=07H, 
ECX=0):EBX[1] > 3) 
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63:49 Reserved. 
Register Address: 572H, 1394 IA32_RTIT_CR3_MATCH 
Trace Filter CR3 Match Register (R/W) If (CPUID.(EAX=07H, 
ECX=0):EBX[25] = 1) 
4:0 Reserved. 
63:5 CR3[63:5] value to match. 


Register Address: 580H, 1408 


IA32_RTIT_ADDRO_A 


Region O Start Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 0) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 581H, 1409 


IA32_RTIT_ADDRO_B 


Region O End Address (R/W) 


If (CPUID(EAX=07H, 
ECX=1):EAX[2:0] > 0) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 582H, 1410 


IA32_RTIT_ADDR1_A 


Region 1 Start Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 1) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 583H, 1411 


IA32_RTIT_ADDR1_B 


Region 1 End Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 1) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 584H, 1412 


IA32_RTIT_ADDR2_A 


Region 2 Start Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 2) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 585H, 1413 


IA32_RTIT_ADDR2_B 


Region 2 End Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 2) 


47:0 Virtual Address. 


63:48 SignExt_VA 


Register Address: 586H, 1414 


IA32_RTIT_ADDR3_A 


Region 3 Start Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 3) 


47:0 Virtual Address. 
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63:48 


SignExt_VA 


Register Address: 587H, 1415 


IA32_RTIT_ADDR3_B 


Region 3 End Address (R/W) 


If (CPUID.(EAX=07H, 
ECX=1):EAX[2:0] > 3) 


47:0 


Virtual Address. 


63:48 


SignExt_VA 


Register Address: 600H, 1536 


IA32_DS_AREA 


DS Save Area (R/W) 


Points to the linear address of the first byte of the DS buffer management area, which is used to 
manage the BTS and PEBS buffers. 


See Section 20.6.3.4, “Debug Store (DS) Mechanism.” 


If( CPUID.O1H:EDX.DS[21] = 1 


63:0 The linear address of the first byte of the DS buffer management area, if 
IA-32e mode is active. 

31:0 The linear address of the first byte of the DS buffer management area, if 
not in |A-32e mode. 

63:32 Reserved if not in IA-32e mode. 


Register Address: G6AOH, 1696 


IA32_U_CET 


Configure User Mode CET (R/W) 


Bits 1:0 are defined if 
CPUID.(EAX=07H, 
ECX=0H):ECX.CET_SS[07] = 1. 
Bits 5:2 and bits 63:10 are defined 
if CPUID.(EAX=07H, 
ECX=0H):EDX.CET_IBT[20] = 1. 


0 SH_STK_EN: When set to 1, enable shadow stacks at CPL3. 

1 WR_SHSTK_EN: When set to 1, enables the WRSSD/WRSSQ instructions. 

2 ENDBR_EN: When set to 1, enables indirect branch tracking. 

3 LEG_IW_EN: Enable legacy compatibility treatment for indirect branch 
tracking. 

4 NO_TRACK_EN: When set to 1, enables use of no-track prefix for indirect 
branch tracking. 

5 SUPPRESS_DIS: When set to 1, disables suppression of CET indirect 
branch tracking on legacy compatibility. 

9:6 Reserved; must be zero. 

10 SUPPRESS: When set to 1, indirect branch tracking is suppressed. This bit 
can be written to 1 only if TRACKER is written as IDLE. 

11 TRACKER: Value of the indirect branch tracking state machine. Values: 
IDLE (0), WAIT_FOR_ENDBRANCH(1). 

63:12 E€B_LEG_BITMAP_BASE: Linear address bits 63:12 of a legacy code page 


bitmap used for legacy compatibility when indirect branch tracking is 
enabled. 


If the processor does not support Intel 64 architecture, these fields have 
only 32 bits; bits 63:32 of the MSRs are reserved. On processors that 
support Intel 64 architecture this value cannot represent a non-canonical 
address. In protected mode, only 31:0 are used. 
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Register Address: 6A2H, 1698 IA32_S_CET 


Configure Supervisor Mode CET (R/W) 


See IA32_U_CET (6A0H) for 
reference; similar format. 


Register Address: 6A4H, 1700 IA32_PLO_SSP 


Linear address to be loaded into SSP on transition to privilege level 0. (R/W) 


If the processor does not support Intel 64 architecture, these fields have only 32 bits; bits 63:32 
of the MSRs are reserved. On processors that support Intel 64 architecture this value cannot 
represent a non-canonical address. In protected mode, only 31:0 are loaded. Bits 1:0 of the MSR 
must be O. Transitions to privilege level O will check that bit 2 is also O. 


If CPUID.(EAX=07H, 
ECX=OH):ECX.CET_SS[07] = 1 


Register Address: 6A5H, 1701 IA32_PL1_SSP 


Linear address to be loaded into SSP on transition to privilege level 1. (R/W) 


If the processor does not support Intel 64 architecture, these fields have only 32 bits; bits 63:32 
of the MSRs are reserved. On processors that support Intel 64 architecture this value cannot 
represent a non-canonical address. In protected mode, only 31:0 are loaded. Bits 1:0 of the MSR 
must be O. Transitions to privilege level 1 from a higher privilege level will check that bit 2 is also 
0. 


If CPUID.(EAX=07H, 
ECX=OH):ECX.CET_SS[07] = 1 


Register Address: 6A6H, 1702 IA32_PL2_SSP 


Linear address to be loaded into SSP on transition to privilege level 2. (R/W) 


If the processor does not support Intel 64 architecture, these fields have only 32 bits; bits 63:32 
of the MSRs are reserved. On processors that support Intel 64 architecture this value cannot 
represent a non-canonical address. In protected mode, only 31:0 are loaded. Bits 1:0 of the MSR 
must be O. Transitions to privilege level 2 from a higher privilege level will check that bit 2 is also 
0. 


If CPUID.(EAX=07H, 
ECX=OH):ECX.CET_SS[07] = 1 


Register Address: 6A7H, 1703 IA32_PL3_SSP 


Linear address to be loaded into SSP on transition to privilege level 3. (R/W) 


If the processor does not support Intel 64 architecture, these fields have only 32 bits; bits 63:32 
of the MSRs are reserved. On processors that support Intel 64 architecture this value cannot 
represent a non-canonical address. In protected mode, only 31:0 are loaded. Bits 1:0 of the MSR 
must be 0. 


If CPUID.(EAX=07H, 
ECX=OH):ECX.CET_SS[07] = 1 


Register Address: 6A8H, 1704 IA32_INTERRUPT_SSP_TABLE_ADDR 


Linear address of a table of seven shadow stack pointers that are selected in |A-32e mode using 
the IST index (when not 0) from the interrupt gate descriptor. (R/W) 

This MSR is not present on processors that do not support Intel 64 architecture. This field cannot 
represent a non-canonical address. 


If CPUID.(EAX=07H, 
ECX=OH):ECX.CET_SS[07] = 1 


Register Address: GEOH, 1760 IA32_TSC_DEADLINE 
TSC Target of Local APIC’s TSC Deadline Mode (R/W) If CPUID.O1H:ECX,[24] = 1 
Register Address: 6€1H, 1761 IA32_PKRS 


Specifies the PK permissions associated with each protection domain for supervisor pages (R/W) 


If CPUID.(EAX=07H, 
ECX=OH):ECX.PKS [31] = 1 


31:0 For domain i (i between O and 15), bits 2i and 2i+1 contain the AD and 
WD permissions, respectively. 
63:32 Reserved. 
Register Address: 770H, 1904 IA32_PM_ENABLE 
Enable/disable HWP (R/W) If CPUID.O6H:EAX[7] = 1 
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0 HWP_ENABLE (R/W1-Once) If CPUID.OGH:EAX.[7] = 1 
See Section 15.4.2, “Enabling HWP.” 
63:1 Reserved. 


Register Address: 771H, 1905 


IA32_HWP_CAPABILITIES 


HWP Performance Range Enumeration (R/O) 


If CPUID.O6H:EAX.[7] = 1 


7:0 Highest_Performance If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities.” 

15:8 Guaranteed_Performance If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities.” 

23:16 Most_Efficient_Performance If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities”. 

31:24 Lowest_Performance If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities.” 

63:32 Reserved. 


Register Address: 772H, 1906 


IA32_HWP_REQUEST_PKG 


Power Management Co 


ntrol Hints for All Logical Processors in a Package (R/W) 


If CPUID.O6H:EAX.[1 1] = 1 


7:0 


Minimum_Performance 
See Section 15.4.4, “Managing HWP.” 


If CPUID.O6H:EAX.[1 1] = 1 


15:8 Maximum_Performance If CPUID.O6H:EAX.[1 1] = 1 
See Section 15.4.4, “Managing HWP.” 

23:16 Desired_Performance If CPUID.O6H:EAX.[1 1] = 1 
See Section 15.4.4, “Managing HWP.” 

31:24 Energy_Performance_Preference If CPUID.O6H:EAX[11] = 1 && 
See Section 15.4.4, “Managing HWP.” CPUID.O6H:EAX.[10] = 1 

41:32 Activity_Window If CPUID.OGH:EAX.[11] = 1 && 
See Section 15.4.4, “Managing HWP.” CPUID.O6H:EAX.[9] = 1 

63:42 Reserved. 


Register Address: 773H, 1907 IA32_HWP_INTERRUPT 


Control HWP Native Int 


errupts (R/W) 


If CPUID.O6H:EAX.[8] = 1 


0 


EN_Guaranteed_Performance_Change 
See Section 15.4.6, “HWP Notifications.” 


If CPUID.O6H:EAX [8] = 1 


EN_Excursion_Minimum 
See Section 15.4.6, “HWP Notifications.” 


If CPUID.O6H:EAX [8] = 1 


63:2 


Reserved. 


Register Address: 774H, 1908 


IA32_HWP_REQUEST 


Power Management Co 


ntrol Hints to a Logical Processor (R/W) 


If CPUID.O6H:EAX.[7] = 1 


7:0 


Minimum_Performance 
See Section 15.4.4, “Managing HWP.” 


If CPUID.O6H:EAX [7] = 1 
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15:8 Maximum_Performance If CPUID.OGH:EAX.[7] = 1 
See Section 15.4.4, “Managing HWP.” 
23:16 Desired_Performance If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.4, “Managing HWP.” 
31:24 Energy_Performance_Preference If CPUID.O6H:EAX.[7] = 1 && 
See Section 15.4.4, “Managing HWP.” CPUID.O6H:EAX.[10] = 1 
41:32 Activity_Window If CPUID.OGH:EAX[7] = 1 && 
See Section 15.4.4, “Managing HWP.” CPUID.OGH:EAX.[9] = 1 
42 Package_Control If CPUID.O6H:EAX.[7] = 1 && 
See Section 15.4.4, “Managing HWP.” CPUID.O6H:EAX[11] = 1 
63:43 Reserved. 
Register Address: 775H, 1909 IA32_PECI_HWP_REQUEST_INFO 
IA32_PECILHWP_REQUEST_INFO 
7:0 Minimum Performance (MINIMUM_PERFORMANCE): Used by OS to read 
the latest value of PECI minimum performance input. Default value is 0. 
15:8 Maximum Performance (MAXIMUM_PERFORMANCE): Used by OS to read 
the latest value of PECI maximum performance input. Default value is 0. 
23:16 Reserved. 
31:24 Energy Performance Preference 
(ENERGY_PERFORMANCE_PREFERENCE): Used by OS to read the latest 
value of PECI Energy Performance Preference input. Default value is O. 
59:32 Reserved. 
60 EPP PECI Override (EPP_PECI_OVERRIDE): 
Indicates whether PECI is currently overriding the Energy Performance 
Preference input. If set to ‘1’, PECI is overriding the Energy Performance 
Preference input. If clear (0), OS has control over Energy Performance 
Preference input. Default value is O. 
61 Reserved. 
62 Max PECI Override (MAX_PECI_OVERRIDE): 
Indicates whether PEC is currently overriding the Maximum 
Performance input. If set to ‘1’, PECI is overriding the Maximum 
Performance input. If clear (0), OS has control over Maximum 
Performance input. Default value is 0. 
63 Min PECI Override (MIN_PECI_OVERRIDE): 
Indicates whether PECI is currently overriding the Minimum Performance 
input. If set to ‘1’, PECI is overriding the Minimum Performance input. If 
clear (0), OS has control over Minimum Performance input. Default value 
is 0. 
Register Address: 776H, 1910 IA32_HWP_CTL 
IA32_HWP_CTL If CPUID.OGH:EAX [22] = 1 
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0 PKG_CTL_POLARITY 


Defines which HWP Request MSR is used whether Thread level or 
package level. When package MSR is used, the thread MSR valid bits 


If CPUID.O6H:EAX.[22] = 1 


Default value is 0. 


define which thread MSR fields override the package. 


63:1 Reserved. 


Register Address: 777H, 1911 


IA32_HWP_STATUS 


Log bits indicating changes to Guaranteed & excursions to Minimum (R/W) 


If CPUID.O6H:EAX.[7] = 1 


0 Guaranteed_Performance_Change (R/WCO) If CPUID.O6H:EAX.[7] = 1 
See Section 15.4.5, “HWP Feedback.” 

1 Reserved. 

2 Excursion_To_Minimum (R/WCO) If CPUID.OGH:EAX.[7] = 1 


See Section 15.4.5, “HWP Feedback.” 


63:3 Reserved. 


Register Address: 802H, 2050 


IA32_X2APIC_APICID 


x2APIC ID Register (R/O) 


Register Address: 803H, 2051 


IA32_X2APIC_VERSION 


If CPUID.O1H:ECX[21] = 1 && 
IA32_APIC_BASE[10] = 1 


x2APIC Version Register (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 808H, 2056 


IA32_X2APIC_TPR 


x2APIC Task Priority Register (R/W) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 80AH, 2058 
x2APIC Processor Priority Register (R/O) 


IA32_X2APIC_PPR 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 80BH, 2059 
x2APIC EO! Register (W/O) 


IA32_X2APIC_EOI 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 80DH, 2061 


IA32_X2APIC_LDR 


x2APIC Logical Destination Register (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 80FH, 2063 


IA32_X2APIC_SIVR 


x2APIC Spurious Interrupt Vector Register (R/W) 


Register Address: 810H, 2064 


IA32_X2APIC_ISRO 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


x2APIC In-Service Register Bits 31:0 (R/O) 


Register Address: 811H, 2065 


IA32_X2APIC_ISR1 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


x2APIC In-Service Register Bits 63:32 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 
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Register Address: 812H, 2066 


IA32_X2APIC_ISR2 


X2APIC In-Service Register Bits 95:64 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE,[10] = 1 


Register Address: 813H, 2067 


IA32_X2APIC_ISR3 


x2APIC In-Service Register Bits 127:96 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 814H, 2068 


IA32_X2APIC_ISR4 


X2APIC In-Service Register Bits 159:128 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 815H, 2069 


IA32_X2APIC_ISR5 


X2APIC In-Service Register Bits 191:160 (R/O) 


If CPUID.OTH:ECX [21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 816H, 2070 


IA32_X2APIC_ISR6 


x2APIC In-Service Register Bits 223:192 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE.[10] = 1 


Register Address: 817H, 2071 
x2APIC In-Service Register Bits 255:224 (R/O) 


IA32_X2APIC_ISR7 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE.[10] = 1 


Register Address: 818H, 2072 


IA32_X2APIC_TMRO 


x2APIC Trigger Mode Register Bits 31:0 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 819H, 2073 


IA32_X2APIC_TMR1 


x2APIC Trigger Mode Register Bits 63:32 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 81AH, 2074 


IA32_X2APIC_TMR2 


x2APIC Trigger Mode Register Bits 95:64 (R/O) 


If CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 81BH, 2075 


IA32_X2APIC_TMR3 


x2APIC Trigger Mode Register Bits 127:96 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 81CH, 2076 


IA32_X2APIC_TMR4 


x2APIC Trigger Mode Register Bits 159:128 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE.[10] = 1 


Register Address: 81DH, 2077 
x2APIC Trigger Mode Register Bits 191:160 (R/O) 


IA32_X2APIC_TMR5 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 81EH, 2078 


IA32_X2APIC_TMR6 


x2APIC Trigger Mode Register Bits 223:192 (R/O) 


If (CPUID.OTH:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1) 


Register Address: 81FH, 2079 


IA32_X2APIC_TMR7 


x2APIC Trigger Mode Register Bits 255:224 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 
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Register Address: 820H, 2080 


IA32_X2APIC_IRRO 


x2APIC Interrupt Request Register Bits 31:0 (R/O) 


If CPUID.O1H:ECX [21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 821H, 2081 


IA32_X2APIC_IRR1 


x2APIC Interrupt Request Register Bits 63:32 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 822H, 2082 


IA32_X2APIC_IRR2 


x2APIC Interrupt Request Register Bits 95:64 (R/O) 


If CPUID.O1H:ECX[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 823H, 2083 


IA32_X2APIC_IRR3 


x2APIC Interrupt Request Register Bits 127:96 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 824H, 2084 


IA32_X2APIC_IRR4 


x2APIC Interrupt Request Register Bits 159:128 (R/O) 


If CPUID.O1H:ECX[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 825H, 2085 
x2APIC Interrupt Request Register Bits 191:160 (R/O) 


IA32_X2APIC_IRR5 


If CPUID.O1H:ECX [21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 826H, 2086 


IA32_X2APIC_IRR6 


x2APIC Interrupt Request Register Bits 223:192 (R/O) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 827H, 2087 


IA32_X2APIC_IRR7 


x2APIC Interrupt Request Register Bits 255:224 (R/O) 


If CPUID.O1H:ECX[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 828H, 2088 


IA32_X2APIC_ESR 


x2APIC Error Status Register (R/W) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 82FH, 2095 


IA32_X2APIC_LVT_CMCI 


x2APIC LVT Corrected Machine Check Interrupt Register (R/W) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 830H, 2096 


IA32_X2APIC_ICR 


x2APIC Interrupt Command Register (R/W) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 832H, 2098 
xX2APIC LVT Timer Interrupt Register (R/W) 


IA32_X2APIC_LVT_TIMER 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 833H, 2099 


IA32_X2APIC_LVT_THERMAL 


x2APIC LVT Thermal Sensor Interrupt Register (R/W) 


If CPUID.OTH:ECX [21] = 1 && 
IA32_APIC_BASE[10] = 1 


Register Address: 834H, 2100 


IA32_X2APIC_LVT_PMI 


x2APIC LVT Performance Monitor Interrupt Register (R/W) 


If CPUID.O1H:ECX.[21] = 1 && 
IA32_APIC_BASE[10] = 1 
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Register Address: 835H, 2101 IA32_X2APIC_LVT_LINTO 
x2APIC LVT LINTO Register (R/W) If CPUID.O1H:ECX[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 836H, 2102 IA32_X2APIC_LVT_LINT1 
X2APIC LVT LINT1 Register (R/W) If CPUID.O1H:ECX[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 837H, 2103 IA32_X2APIC_LVT_ERROR 
x2APIC LVT Error Register (R/W) If CPUID.O1H:ECX[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 838H, 2104 1A32_X2APIC_INIT_COUNT 
X2APIC Initial Count Register (R/W) If CPUID.O1H:ECX [21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 839H, 2105 1A32_X2APIC_CUR_COUNT 
x2APIC Current Count Register (R/O) If CPUID.O1H:ECX.[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 83EH, 2110 IA32_X2APIC_DIV_CONF 
x2APIC Divide Configuration Register (R/W) If CPUID.O1H:ECX.[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 83FH, 2111 IA32_X2APIC_SELF_IPI 
x2APIC Self IPI Register (W/O) If CPUID.O1H:ECX[21] = 1 && 
1A32_APIC_BASE.[10] = 1 
Register Address: 981H, 2433 IA32_TME_CAPABILITY 
Memory Encryption Capability MSR If CPUID.O7H:ECX.[13] = 1 
0 Support for AES-XTS 128-bit encryption algorithm. 
(NIST standard) 
1 Support for AES-XTS 128-bit encryption with integrity algorithm. 
2 Support for AES-XTS 256-bit encryption algorithm. 
29:3 Reserved. 
30 SUPPORT_IA32_TME_CLEAR_SAVED_KEY 
Support for the [A32_TME_CLEAR_SAVED_KEY MSR. 
31 TME encryption bypass supported. 
35:32 MK_TME_MAX_KEYID_BITS 
Number of bits which can be allocated for usage as key identifiers for 
multi-key memory encryption. 
4 bits allow for a maximum value of 15, which could address 32K keys. 
Zero if TME-MK is not supported. 
50:36 MK_TME_MAX_KEYS 
Indicates the maximum number of keys which are available for usage. 
This value may not be a power of 2. 
KeylD 0 is specially reserved and is not accounted for in this field. 
63:51 Reserved. 
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Register Address: 982H, 2434 IA32_TME_ACTIVATE 


Memory Encryption Activation MSR 


This MSR is used to lock the MSRs listed below. Any write to the following MSRs will be ignored 
after they are locked. The lock is reset when CPU is reset. 


= 1A32_TME_ACTIVATE 


* [A32_TME_EXCLUDE_MASK 
» [A32_TME_EXCLUDE_BASE 
Note that |A32_TME_EXCLUDE_MASK and IA32_TME_EXCLUDE_BASE must be configured before 


IA32_TME_ACTIVATE. 


If CPUID.O7H:ECX.[1 3] = 1 


0 


Lock R/O - Will be set upon successful WRMSR (or first SMI); written 
value ignored. 


Hardware Encryption Enable 


This bit also enables TME-MK; TME-MK cannot be enabled without 
enabling encryption hardware. 


2 Key Select 
0: Create a new TME key (expected cold/warm boot). 
1: Restore the TME key from storage (Expected when resume from 
standby). 
3 Save TME Key for Standby 
Save key into storage to be used when resume from standby. 
Note: This may not be supported in all processors. 
7:4 TME Policy/Encryption Algorithm 
Only algorithms enumerated in IA32_TME_CAPABILITY are allowed. 
For example: 
0000 - AES-XTS-128. 
0001 - AES-XTS-128 with integrity. 
0010 - AES-XTS-256. 
Other values are invalid. 
30:8 Reserved. 
31 TME Encryption Bypass Enable 


When encryption hardware is enabled: 


Total Memory Encryption is enabled using a CPU generated ephemeral 
key based on a hardware random number generator when this bit is 
set to 0. 

Total Memory Encryption is bypassed (no encryption/decryption for 
KeylDO) when this bit is set to 1. 


Software must inspect Hardware Encryption Enable (bit 1) and TME 
encryption bypass Enable (bit 31) to determine if TME encryption is 
enabled. 
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35:32 


MK_TME_KEYID_BITS 
Reserved if TME-MK is not enumerated, otherwise: 


The number of key identifier bits to allocate to TME-MK usage. Similar to 
enumeration, this is an encoded value. 

Writing a value greater than MK_TME_MAX_KEYID_BITS will result in 
#GP. 

Writing a non-zero value to this field will #GP if bit 1 of EAX (Hardware 
Encryption Enable) is not also set to ‘1, as encryption hardware must be 
enabled to use TME-MK. 


Example: To support 255 keys, this field would be set to a value of 8. 


47:36 


Reserved. 


63:48 


MK_TME_CRYPTO_ALGS 

Reserved if TME-MK is not enumerated, otherwise: 
Bit 48: AES-XTS 128. 

Bit 49: AES-XTS 128 with integrity. 

Bit 50: AES-XTS 256. 

Bit 63:51: Reserved (#GP) 


Bitmask for BIOS to set which encryption algorithms are allowed for 
TME-MK, would be later enforced by the key loading ISA (‘1 = allowed). 


Register Address: 983H, 2435 IA32_TME_EXCLUDE_MASK 


Memory Encryption Exclude Mask 


If CPUID.O7H:ECX.[1 3] = 1 


10:0 


Reserved. 


11 


Enable: When set to ‘1’, then TME_EXCLUDE_BASE and 
TME_EXCLUDE_MASK are used to define an exclusion region for 
TME/TME-MK (for KeyID=0). 


MAXPHYSADDR-1:12 


TMEEMASK: This field indicates the bits that must match TMEEBASE in 
order to qualify as a TME/TME-MK (for KeyID=0) exclusion memory range 
access. 


63:MAXPHYSADDR 


Reserved; must be zero. 


Register Address: 984H, 2436 


IA32_TME_EXCLUDE_BASE 


11:0 


Memory Encryption Exclude Base 


Reserved. 


IF CPUID.O7H:ECX.[1 3] = 1 


MAXPHYSADDR-1:12 


TMEEBASE: Base physical address to be excluded for TME/TME-MK (for 
KeylD=0) encryption. 


63:MAXPHYSADDR 


Reserved; must be zero. 


Register Address: 985H, 2437 


IA32_UINTR_RR 


User Interrupt Request 


Register (R/W) 


IF CPUID.07H.01H:EDX[1 3]=1 


63:0 


UIRR 
Bitmap of requested user interrupt vectors. 


Register Address: 986H, 2438 IA32_UINTR_HANDLER 


User Interrupt Handler Address (R/W) 


IF CPUID.O7H.01H:EDX[1 3]=1 
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UIHANDLER 
User interrupt handler linear address. 


Register Address: 987H, 2439 


IA32_UINTR_STACKADJUST 


User Interrupt Stack Adjustment (R/W) 


IF CPUID.O7H.01H:EDX[13]=1 


0 LOAD_RSP 

User interrupt stack mode. 
2:1 Reserved. 
63:3 STACK_ADJUST 


Stack adjust value. 


Register Address: 988H, 2440 


IA32_UINTR_MISC 


User-Interrupt Target-Table Size and Notification Vector (R/W) 


If CPUID.O7H.01H:EDX[13]=1 


31:0 UITTSZ 
The highest index of a valid entry in the user-interrupt target table. Valid 
entries are indices 0..UITTSZ (inclusive). 

39:32 UINV 
User-interrupt notification vector. 

63:40 Reserved. 


Register Address: 989H, 2441 IA32_UINTR_PD 


User Interrupt PID Address (R/W) 


If CPUID.O7H.01H:EDX[13]=1 


5:0 


Reserved. 


63:6 


UPIDADDR 


User-interrupt notification processing accesses a UPID at this linear 
address. 


Register Address: 98AH, 2442 


IA32_UINTR_TT 


User-Interrupt Target Table (R/W) 


If CPUID.O7H.01H:EDX[1 3]=1 


0 SENDUIPI_ENABLE 

User-interrupt target table is valid. 
3:1 Reserved. 
63:4 UITTADDR 


User-interrupt target table base linear address. 


Register Address: 990H, 2448 


|[A32_COPY_STATUS? 


Status of Most Recent Platform to Local or Local to Platform Copies (R/O) 


If ((CPUID.1 9H:EBX[4] = 1) && 
(CPUID.(07H,0).ECX[23] = 1)) 


0 IWKEY_COPY_SUCCESSFUL If (CPUID.1 9H:EBX[4] = 1) && 
Status of most recent copy to or from IWKeyBackup. (CPUID.(07H,0).ECX[23] = 1)) 
63:1 Reserved. 


Register Address: 991H, 2449 


|A32_IWKEYBACKUP_STATUS? 


Information about IWKeyBackup Register (R/O) 


If ((CPUID.1 9H:EBX[4] = 1) && 
(CPUID.(07H,0).ECX[23] =1)) 
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Backup/Restore Valid 


Cleared when a write to IWKeyBackup is initiated, and then set when the 
latest write of I|WKeyBackup has been written to storage that persists 
across S3/S4 sleep state. If S3/S4 is entered between when an 
IWKeyBackup write occurs and when this bit is set, then IWKeyBackup 
may not be recovered after S3/S4 exit. During S3/S4 sleep state exit 
(system wake up), this bit is cleared. It is set again when IWKeyBackup is 
restored from persistent storage and thus available to be copied to 
IWKey using [A32_COPY_PLATFORM_TO_LOCAL MSR. Another write to 
IwWKeyBackup (via |A32_COPY_LOCAL_TO_PLATFORM MSR) may fail if a 
previous write has not yet set this bit. 


IF ((CPUID.19H:EBX[4] = 1) && 
(CPUID.(07H,0).ECX[23] =1)) 


Reserved. 


Backup Key Storage Read/Write Error 


Updated prior to backup/restore valid being set. Set when an error is 
encountered while backing up or restoring a key to persistent storage. 


IF ((CPUID.19H:EBX[4] = 1) && 
(CPUID.(07H,0).ECX[23] =1)) 


63:4 


IWKeyBackup Consumed 


Set after the previous backup operation has been consumed by the 
platform. This does not indicate that the system is ready for a second 
IWKeyBackup write as the previous IWKeyBackup write may still need to 
set Backup/restore valid. 


Reserved. 


IF ((CPUID.19H:EBX[4] = 1) && 
(CPUID.(07H,0).ECX[23] =1)) 


Register Address: 9FBH, 2555 


IA32_TME_CLEAR_SAVED_KEY 


IA32_TME_CLEAR_SAVED_KEY (W/O) 


TME_CLEAR_SAVED_KEY 
Clear saved TME keys. 


Reserved. 


Register Address: C80H, 3200 


IA32_DEBUG_INTERFACE 


Silicon Debug Feature Control (R/W) 


If CPUID.O1H:ECX.[11] = 1 


0 Enable (R/W) If CPUID.O1H:ECX,[1 1] = 1 
BIOS set 1 to enable Silicon debug features. Default is 0. 

29:1 Reserved. 

30 Lock (R/W): If 1, locks any further change to the MSR. The lock bit is set | If CPUID.O1H:ECX.[11] = 1 
automatically on the first SMI assertion even if not explicitly set by BIOS. 
Default is 0. 

31 Debug Occurred (R/O): This “sticky bit” is set by hardware to indicate the | If CPUID.O1H:ECX.[11] = 1 
status of bit 0. Default is 0. 

63:32 Reserved. 


Register Address: C81H, 3201 


IA32_L3_QOS_CFG 


L3 QOS Configuration (R/W) 


If (CPUID.(EAX=10H, 
ECX=1):ECX [2] = 1) 


Enable (R/W) 


Set 1 to enable L3 CAT masks and COS to operate in Code and Data 
Prioritization (CDP) mode. 


Reserved. Attempts to write to reserved bits result in a #GP(O). 


2-56 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
Register Address: C82H, 3202 IA32_L2_QOS_CFG 
L2 QOS Configuration (R/W) If (CPUID.(EAX=10H, 


ECX=2):ECX[2] = 1) 


0 Enable (R/W) 


Set 1 to enable L2 CAT masks and COS to operate in Code and Data 
Prioritization (CDP) mode. 


63:1 Reserved. Attempts to write to reserved bits result in a #GP(O). 

Register Address: C83H, 3203 IA32_L3_I0_QOS_CFG 

L3 1/0 QOS Configuration (R/W) If (CPUID.(EAX=0FH, 

This MSR is used to enable the I/O RDT features. ECX=1):EAX.[10:9] = 1) 

0 L3 I/O RDT Allocation Enable. 

1 L3 1/0 RDT Monitoring Enable. 

63:2 Reserved. 

Register Address: C8DH, 3213 IA32_QM_EVTSEL 

Monitoring Event Select Register (R/W) If (CPUID.(EAX=07H, 
ECX=0):EBX.[1 2] = 1) 

7:0 Event ID: ID of a supported monitoring event to report via [A32_QM_CTR. 

31:8 Reserved. 

N+31:32 Resource Monitoring ID: ID for monitoring hardware to report monitored | N = Ceil (Logs (CPUID.(EAX= OFH, 

data via IA32_QM_CTR. ECX=0H).EBX[31:0] +1)) 

63:N+32 Reserved. 

Register Address: C8EH, 3214 IA32_QM_CTR 

Monitoring Counter Register (R/O) If (CPUID.(EAX=07H, 
ECX=0):EBX.[1 2] = 1) 

61:0 Resource Monitored Data. 

62 Unavailable: If 1, indicates data for this RMID is not available or not 


monitored for this resource or RMID. 


63 Error: If 1, indicates an unsupported RMID or event type was written to 
IA32_PQR_QM_EVTSEL. 


Register Address: C8FH, 3215 IA32_PQR_ASSOC 


Resource Association Register (R/W) If ((CPUID.(EAX=07H, 
ECX=0):EBX[1 2] =1) or 
(CPUID.(EAX=07H, 
E€CX=0):EBX[15] =1)) 


N-1:0 Resource Monitoring ID (R/W): ID for monitoring hardware to track N = Ceil (Logs (CPUID.(EAX= OFH, 
internal operation, e.g., Memory access. ECX=0H).EBX[31:0] +1)) 

31:N Reserved. 

63:32 COS (R/W): The class of service (COS) to enforce (on writes); returns the | If (CPUID.(EAX=07H, 
current COS when read. ECX=0):EBX.[15] = 1) 

Register Address: CQOH—D8FH, 3216-3471 Reserved MSR Address Space for CAT Mask Registers 


See Section 18.19.4.1, “Enumeration and Detection Support of Cache Allocation Technology.” 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Register Address: C90H, 3216 


IA32_L3_MASK_O 


L3 CAT Mask for COSO (R/W) 


If (CPUID.(EAX=10H, 
ECX=0H):EBX[1] != 0) 


31:0 


Capacity Bit Mask (R/W) 


63:32 


Reserved. 


Register Address: C9OH+n, 3216+n 


IA32_L3_MASK_n 


L3 CAT Mask for COSn (R/W) 


n = CPUID.(EAX=10H, 
ECX=1H):€DX[15:0] 


31:0 


Capacity Bit Mask (R/W) 


63:32 


Reserved. 


Register Address: D1OH—D4FH, 3344-3407 


Reserved MSR Address Space for L2 CAT Mask Registers 


See Section 18.19.4.1, “Enumeration and Detection Support of Cache Allocation Technology.” 


Register Address: D10H, 3344 


IA32_L2_MASK_O 


L2 CAT Mask for COSO (R/W) 


If (CPUID.(EAX=10H, 
ECX=0H):EBX[2] != 0) 


31:0 
63:32 


Capacity Bit Mask (R/W) 


Reserved. 


Register Address: D1OH+n, 3344+n 


IA32_L2_MASK_n 


L2 CAT Mask for COSn (R/W) 


n = CPUID.(EAX=10H, 
ECX=2H):€DX[15:0] 


31:0 


Capacity Bit Mask (R/W) 


63:32 


Reserved. 


Register Address: D9SOH, 3472 


IA32_BNDCFGS 


Supervisor State of MPX Configuration (R/W) 


if (CPUID.(EAX=07H, 
ECX=0H):EBX[14] = 1) 


0 EN: Enable Intel MPX in supervisor mode. 

1 BNDPRESERVE: Preserve the bounds registers for near branch 
instructions in the absence of the BND prefix. 

11:2 Reserved, must be zero. 

63:12 Base Address of Bound Directory. 


Register Address: D91H, 3473 


IA32_COPY_LOCAL_TO_PLATFORM? 


Copy Local State to Platform State (W) 


IF ((CPUID.1 SH:EBX[4] = 1) && 


(CPUID.(EAX=07H, 
ECX=0H).ECX[23] = 1) 


63:1 


IWKeyBackup 
Copy IWKey to IWKeyBackup. 


Reserved. 


IF ((CPUID.1 SH:EBX[4] = 1) && 


(CPUID.(EAX=07H, 
ECX=0H).ECX[23] = 1) 


Register Address: D92H, 3474 


IA32_COPY_PLATFORM_TO_LOCAL? 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Copy Platform State to Local State (W) 


IF ((CPUID.1 SH:EBX[4] = 1) && 


(CPUID.(EAX=07H, 
ECX=0H).ECX[23] = 1)) 


0 IWKeyBackup IF ((CPUID.1 SH:EBX[4] = 1) && 
Copy IWKeyBackup to IwKey. (CPUID.(EAX=07H, 
ECX=0H).ECX[23] = 1)) 
63:1 Reserved. 


Register Address: D93H, 3475 


IA32_PASID 


Process Address Space Identifier. (R/W) 


19:0 Process address space identifier (PASID). Specifies the PASID of the 
currently running software thread. 

30:20 Reserved. 

31 Valid. Execution of ENQCMD causes a #GP if this bit is clear. 

63:32 Reserved. 


Register Address: DAOH, 3488 


IA32_XSS 


Extended Supervisor State Mask (R/W) 


If( CPUID.(ODH, 1):EAX.[3] = 1 


7:0 Reserved. 

8 PT State (R/W) 

9 Reserved. 

10 PASID State (R/W) 
11 CET_U State (R/W) 
12 CET_S State (R/w) 
13 HDC State (R/W) 
14 UINTR State (R/W) 
15 LBR State (R/W) 
16 HWP State (R/W) 
63:17 Reserved. 


Register Address: DBOH, 3504 


IA32_PKG_HDC_CTL 


Package Level Enable/disable HDC (R/W) 


If CPUID.O6H:EAX.[1 3] = 1 


0 HDC_Pkg_Enable (R/W) If CPUID.OGH:EAX.[13] = 1 
Force HDC idling or wake up HDC-idled logical processors in the package. 
See Section 15.5.2, “Package level Enabling HDC.” 

63:1 Reserved. 


Register Address: DB1H, 3505 


IA32_PM_CTL1 


Enable/disable HWP (R/W) 


If CPUID.O6H:EAX.[1 3] = 1 


0 


HDC_Allow_Block (R/W) 


Allow/Block this logical processor for package level HDC control. See 
Section 15.5.3. 


If CPUID.O6H:EAX.[1 3] = 1 


63:1 


Reserved. 


Register Address: DB2H, 3506 


IA32_THREAD_STALL 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal 


Architectural MSR Name (Former MSR Name) 


Bit Fields 


MSR/Bit Description 


Comment 


Per-Logical_Processor_ID HDC Idle Residency (R/O) 


If CPUID.O6H:EAX.[1 3] = 1 


63:0 Stall_Cycle_Cnt (R/W) If CPUID.OGH:EAX[13] = 1 
Stalled cycles due to HDC forced idle on this logical processor. See 
Section 15.5.4.1. 

Register Address: 1200H—121FH, 4608—4639 IA32_LBR_x_INFO 


Last Branch Record Entry X Info Register (R/W) 
An attempt to read or write [A32_LBR_x_INFO such that x = IA32_LBR_DEPTH.DEPTH will #GP. 


15:0 


CYC_CNT 


The elapsed CPU cycles (saturating) since the last LBR was recorded. See 
Section 18.1.3.3. 


Reset Value: 0 


55:16 


59:56 


Undefined, may be zero or non-zero. Writes of non- zero values do not 
fault, but reads may return a different value. 
BR_TYPE 

The branch type recorded by this LBR. Encodings: 
OOOOB: COND 

0001B: JMP Indirect 

00108: JMP Direct 

0011B: CALL Indirect 

01008: CALL Direct 

0101B: RET 

011xB: Reserved 

1xxxB: Other Branch 


Reset Value: 0 


Reset Value: 0 


60 


CYC_CNT_VALID 
CYC_CNT value is valid. See Section 19.1.3.3. 


Reset Value: 0 


61 


TSX_ABORT 


This LBR record is a TSX abort. On processors that do not support Intel 
TSX (CPUID.O7H.EBX.HLE[bit 4]=0 and CPUID.O7H.EBX.RTM[bit 1 1]=0), 
this bit is undefined. 


Reset Value: 0 


62 


63 


IN_TSX 

This LBR record records a branch that retired during a TSX transaction. 
On processors that do not support Intel TSX (CPUID.O7H.EBX.HLE[bit 
4]=0 and CPUID.O7H.EBX.RTM[bit 11]=0), this bit is undefined. 
MISPRED 


The recorded branch direction (conditional branch) or target (indirect 
branch) was mispredicted. 


Reset Value: 0 


Reset Value: 0 


Register Address: 1406H, 5126 IA32_MCU_CONTROL 


MCU Control (R/W) 


Controls the behavior of the Microcode Update Trigger MSR, |[A32_BIOS_UPDT_TRIG. 


If CPUID.O7H.OH:EDX[29]=1 && 
MSR.IA32_ARCH_CAPABILITIES.M 
CU_CONTROL=1 


0) 


LOCK 


Once set, further writes to this MSR will cause a #GP(0) fault. Bypassed 
during SMM if EN_SMM_BYPASS (bit 2) is set. 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
1 DIS_MCU_LOAD 
If this bit is set on a given logical processor, then any subsequent 
attempts to load a microcode update by that logical processor will be 
silently dropped (WRMSR 0x79 has no effect). 
2 EN_SMM_BYPASS 
If set, then writes to IA32_MCU_CONTROL are allowed during SMM 
regardless of the LOCK bit. This enables BIOS to Opt-In to the SMM 
Bypass functionality. 
63:3 Reserved. 
Register Address: 14CEH, 5326 IA32_LBR_CTL 
Last Branch Record Enabling and Configuration Register (R/W) 
0 LBREn Reset Value: 0 
When set, enables LBR recording. 
1 OS Reset Value: 0 
When set, allows LBR recording when CPL == 0. 
2 USR Reset Value: 0 
When set, allows LBR recording when CPL != 0. 
3 CALL_STACK Reset Value: 0 
When set, records branches in call-stack mode. See Section 19.1.2.4. 
15:4 Reserved. Reset Value: 0 
16 COND 
When set, records taken conditional branches. See Section 19.1.2.3. 
17 NEAR_REL_JMP 
When set, records near relative JMPs. See Section 19.1.2.3. 
18 NEAR_IND_JMP 
When set, records near indirect JMPs. See Section 19.1.2.3. 
19 NEAR_REL_CALL 
When set, records near relative CALLs. See Section 19.1.2.3. 
20 NEAR_IND_CALL 
When set, records near indirect CALLs. See Section 19.1.2.3. 
21 NEAR_RET 
When set, records near RETs. See Section 19.1.2.3. 
22 OTHER_BRANCH 
When set, records other branches. See Section 19.1.2.3. 
63:23 Reserved. 
Register Address: 14CFH, 5327 IA32_LBR_DEPTH 
Last Branch Record Maximum Stack Depth Register (R/W) 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 
N:0 DEPTH Reset Value: Varies 


The number of LBRs to be used for recording. Supported values are 
indicated by the bitmap in CPUID.(EAX=01CH,ECX=0):EAX[7:0]. The reset 
value will match the maximum supported by the CPU. Writes of 
unsupported values will #GP fault. 


63:N+1 Reserved. Reset Value: 0 
Register Address: 1500H—151FH, 5376—5407 IA32_LBR_x_FROM_IP 


Last Branch Record entry X source IP register (R/W). 


An attempt to read or write [A32_LBR_x_FROML_IP such that x = |[A32_LBR_DEPTH.DEPTH will 
#CP, 


63:0 FROM_IP Reset Value: 0 


The source IP of the recorded branch or event, in canonical form. Writes 
to bits above MAXLINADDR-1 are ignored. 


Register Address: 1600H—161FH, 5632—5663 IA32_LBR_x_TO_IP 
Last Branch Record Entry X Destination IP Register (R/W) 
An attempt to read or write [A32_LBR_x_TO_IP such that x = [A32_LBR_DEPTH.DEPTH will #GP. 


63:0 TO_IP Reset Value: 0 


The destination IP of the recorded branch or event, in canonical form. 
Writes to bits above MAXLINADDR-1 are ignored. 


Register Address: 17D0H, 6096 IA32_HW_FEEDBACK_PTR 
Hardware Feedback Interface Pointer If CPUID.O6H:EAX.[1 9] = 1 


0 Valid (R/W) 


When set to 1, indicates a valid pointer is programmed into the ADDR 
field of the MSR. 


11:1 Reserved. 


(MAXPHYADDR-1):12 | ADDR (R/W) 


Physical address of the page frame of the first page of the hardware 
feedback interface structure. 


63:MAXPHYADDR Reserved. 


Register Address: 17D1H, 6097 IA32_Hw_FEEDBACK_CONFIG 
Hardware Feedback Interface Configuration If CPUID.O6H:EAX.[1 9] = 1 
0 Enable (R/W) 
When set to 1, enables the hardware feedback interface. 
63:1 Reserved. 
Register Address: 17D2H, 6098 IA32_THREAD_FEEDBACK_CHAR 
Thread Feedback Characteristics (R/O) If CPUID.OGH:EAX.[23] = 1 
7:0 Application Class ID, pointing into the Intel Thread Director structure. 
62:8 Reserved. 
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Table 2-2. IA-32 Architectural MSRs (Contd.) 


Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 


Bit Fields MSR/Bit Description Comment 


63 Valid bit. When set to 1 the OS Scheduler can use the Class ID (in bits 7:0) 
for its scheduling decisions. 

If this bit is O, the Class ID field should be ignored. It is recommended that 
the OS uses the last known Class ID of the software thread for its 
scheduling decisions. 


Register Address: 17D4H, 6100 1A32_HwW_FEEDBACK_THREAD_CONFIG 
Hardware Feedback Thread Configuration (R/W) 
0 Enables Intel Thread Director. When set to 1, logical processor scope Intel 
Thread Director is enabled. Default is O (disabled). 
63:1 Reserved. 
Register Address: 17DAH, 6106 IA32_HRESET_ENABLE 
History Reset Enable (R/W) 
0 Enable reset of the Intel Thread Director history. 
31:1 Reserved for other capabilities that can be reset by the HRESET 
instruction. 
63:32 Reserved. 
Register Address: 1B01H, 6913 1A32_UARCH_MISC_CTL 
IA32_UARCH_MISC_CTL If 
1A32_ARCH_CAPABILITIES[1 2]=1 
0 Data Operand Independent Timing Mode (DOITM). If 
1A32_ARCH_CAPABILITIES[12]=1 
63:1 Reserved. 
Register Address: 4000_O000H—4000_OOFFH Reserved MSR Address Space 
All existing and future processors will not implement MSRs in this range. 
Register Address: COOO_O080H IA32_EFER 
Extended Feature Enables If ( CPUID.80000001H:EDX.[20] || 
CPUID.80000001H:EDX.[29]) 
0 SYSCALL Enable: |A32_EFER.SCE (R/W) 
Enables SYSCALL/SYSRET instructions in 64-bit mode. 
7:1 Reserved. 


IA-32e Mode Enable: |A32_EFER.LME (R/w) 
Enables I|A-32e mode operation. 


9 Reserved. 
10 IA-32e Mode Active: |A32_EFER.LMA (R) 
Indicates IA-32e mode is active when set. 
11 Execute Disable Bit Enable: |A32_EFER.NXE (R/W) 
63:12 Reserved. 
Register Address: COO0_0081H IA32_STAR 
System Call Target Address (R/W) If CPUID.80000001:EDX.[29] = 1 
Register Address: COOO_0082H IA32_LSTAR 
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Register Address: Hex, Decimal Architectural MSR Name (Former MSR Name) 
Bit Fields MSR/Bit Description Comment 

IA-32e Mode System Call Target Address (R/W) If CPUID.8B0000001:EDX[29] = 1 

Target RIP for the called procedure when SYSCALL is executed in 64-bit mode. 

Register Address: COOO_0083H IA32_CSTAR 

IA-32e Mode System Call Target Address (R/W) If CPUID.80000001:EDX[29] = 1 

Not used, as the SYSCALL instruction is not recognized in compatibility mode. 

Register Address: COOO_0084H IA32_FMASK 

System Call Flag Mask (R/W) If CPUID.80000001:EDX [29] = 1 

Register Address: CO00_0100H IA32_FS_BASE 

Map of BASE Address of FS (R/W) If CPUID.80000001:EDX.[29] = 1 

Register Address: CO00_0101H IA32_GS_BASE 

Map of BASE Address of GS (R/W) If CPUID.80000001:EDX.[29] = 1 

Register Address: CO00_0102H IA32_KERNEL_GS_BASE 

Swap Target of BASE Address of GS (R/W) If CPUID.80000001:EDX.[29] = 1 

Register Address: CO00_0103H IA32_TSC_AUX 

Auxiliary TSC (R/W) If CPUID.80000001H: EDX[27] = 1 
or CPUID.(EAX=7,ECX=0):ECX [bit 
22)=1 

31:0 AUX: Auxiliary signature of TSC. 

63:32 Reserved. 


NOTES: 

1. Some older processors may have supported this MSR as model-specific and do not enumerate it with CPUID. 

2. In processors based on Intel NetBurst® microarchitecture, MSR addresses 180H-197H are supported, software must treat them as 
model-specific. Starting with Intel Core Duo processors, MSR addresses 180H-185H, 188H-197H are reserved. 

3. The *_ADDR MSRs may or may not be present; this depends on flag settings in IA32_MCi_STATUS. See Section 16.3.2.3 and Section 
16.3.2.4 for more information. 

4, MAXPHYADDR is reported by CPUID.80000008H:EAX[7:0]. 

5. Further details on Key Locker and usage of this MSR can be found here: 


https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 


2.2 MSRS IN THE INTEL® CORE™ 2 PROCESSOR FAMILY 


Table 2-3 lists model-specific registers (MSRs) for the Intel Core 2 processor family and for Intel Xeon processors 
based on Intel Core microarchitecture, architectural MSR addresses are also included in Table 2-3. These proces- 
sors have a CPUID Signature DisplayFamily_DisplayModel value of 06_OFH, see Table 2-1. 


MSRs listed in Table 2-2 and Table 2-3 are also supported by processors based on the Enhanced Intel Core microar- 
chitecture. Processors based on the Enhanced Intel Core microarchitecture have a CPUID Signature DisplayFami- 
ly_DisplayModel value of 06_17H. 
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The column “Shared/Unique” applies to multi-core processors based on Intel Core microarchitecture. “Unique” 
means each processor core has a separate MSR, or a bit field in an MSR governs only a core independently. 
“Shared” means the MSR or the bit field in an MSR address governs the operation of both processor cores. 


Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ce 
Register Address: OH, O IA32_P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors.” Unique 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors.” Unique 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Unique 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and Table 2-2. Unique 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Shared 
See Table 2-2. 
Register Address: 17H, 23 MSR_PLATFORM_ID 
Model Specific Platform ID (R) Shared 
7:0 Reserved. 
12:8 Maximum Qualified Ratio (R) 
The maximum allowed bus ratio. 
49:13 Reserved. 
52:50 See Table 2-2. 
63:53 Reserved. 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Unique 
Register Address: 2AH, 42 MSR_EBL_CR_POWERON 
Processor Hard Power-On Configuration (R/W) Shared 
Enables and disables processor features; (R) indicates current processor configuration. 
0 Reserved. 
1 Data Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processors implement R/W. 
2 Response Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processor implements R/W. 
3 MCERR# Drive Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processors implement R/W. 
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Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


When this bit is set and the lock bit is set, this makes the SMRR_PHYS_BASE 
and SMRR_PHYS_MASK registers read visible and writeable while in SMM. 


Register Information / Bit Fields Bit Description ae 
4 Address Parity Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processors implement R/W. 
Reserved. 
Reserved. 
BINIT# Driver Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processors implement R/W. 
8 Output Tri-state Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
9 Execute BIST (R/O) 
1 = Enabled; 0 = Disabled. 
10 MCERR# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
11 Intel TXT Capable Chipset. (R/O) 
1 = Present; 0 = Not Present. 
12 BINIT# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
13 Reserved. 
14 1 MByte Power on Reset Vector (R/O) 
1 = 1 MByte; O = 4 GBytes. 
15 Reserved. 
17:16 APIC Cluster ID (R/O) 
18 N/2 Non-Integer Bus Ratio (R/O) 
O = Integer ratio; 1 = Non-integer ratio. 
19 Reserved. 
21:20 Symmetric Arbitration ID (R/O) 
26:22 Integer Bus Frequency Ratio (R/O) 
Register Address: 3AH, 58 MSR_FEATURE_CONTROL 
Control Features in Intel 64 Processor (R/W) Unique 
See Table 2-2. 
3 SMRR Enable (R/WL) Unique 


Register Address: 40H, 64 


MSR_LASTBRANCH_O_FROM_IP 
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Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description ie 
Last Branch Record 0 From IP (R/W) Unique 
One of four pairs of last branch record registers on the last branch record stack. The From_IP part of the stack 
contains pointers to the source instruction. See also: 
* Last Branch Record Stack TOS at 1C9SH. 
* Section 18.5. 
Register Address: 41H, 65 MSR_LASTBRANCH_1_FROM_IP 
Last Branch Record 1 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 42H, 66 MSR_LASTBRANCH_2_FROM_IP 
Last Branch Record 2 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 43H, 67 MSR_LASTBRANCH_3_FROM_IP 
Last Branch Record 3 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 60H, 96 MSR_LASTBRANCH_O_TO_IP 
Last Branch Record 0 To IP (R/W) Unique 
One of four pairs of last branch record registers on the last branch record stack. This To_IP part of the stack contains 
pointers to the destination instruction. 
Register Address: 61H, 97 MSR_LASTBRANCH_1_TO_IP 
Last Branch Record 1 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 62H, 98 MSR_LASTBRANCH_2_TO_IP 
Last Branch Record 2 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 63H, 99 MSR_LASTBRANCH_3_TO_IP 
Last Branch Record 3 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 79H, 121 IA32_BlOS_UPDT_TRIG 
BIOS Update Trigger Register (W) Unique 
See Table 2-2. 
Register Address: 8BH, 139 IA32_BlOS_SIGN_ID 
BIOS Update Signature ID (R/W) Unique 
See Table 2-2. 
Register Address: AQH, 160 MSR_SMRR_PHYSBASE 
System Management Mode Base Address register (WO in SMM) Unique 


Model-specific implementation of SMRR-like interface, read visible and write only in SMM. 


11:0 Reserved. 


31:12 PhysBase: SMRR physical Base Address. 
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Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


This field indicates the intended scalable bus clock speed for processors based on Enhanced Intel Core 
microarchitecture. 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description shared 
Unique 
63:32 Reserved. 
Register Address: A1H, 161 MSR_SMRR_PHYSMASK 
System Management Mode Physical Address Mask register (WO in SMM) Unique 
Model-specific implementation of SMRR-like interface, read visible and write only in SMM. 
10:0 Reserved. 
11 Valid: Physical address base and range mask are valid. 
31:12 PhysMask: SMRR physical address range mask. 
63:32 Reserved. 
Register Address: C1H, 193 IA32_PMCO 
Performance Counter Register Unique 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Unique 
See Table 2-2. 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Shared 
This field indicates the intended scalable bus clock speed for processors based on Intel Core microarchitecture. 
2:0 * 101B: 100 MHz (FSB 400) 
* 001B: 133 MHz (FSB 533) 
= 011B: 167 MHz (FSB 667) 
* 010B; 200 MHz (FSB 800) 
* QOOB: 267 MHz (FSB 1067) 
* 100B: 333 MHz (FSB 1333) 
133.33 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is 0018B. 
166.67 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is 0118B. 
266.67 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is OOOB. 
333.33 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is 100B. 
63:3 Reserved. 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Shared 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description shared 
Unique 

2:0 * 101B: 100 MHz (FSB 400) 

* 001B: 133 MHz (FSB 533) 

= 011B: 167 MHz (FSB 667) 

* 010B: 200 MHz (FSB 800) 

* OOOB: 267 MHz (FSB 1067) 

* 100B: 333 MHz (FSB 1333) 

* 110B: 400 MHz (FSB 1600) 

133.33 MHz should be utilized if performing calculation with System Bus 

Speed when encoding is 001B. 

166.67 MHz should be utilized if performing calculation with System Bus 

Speed when encoding is 0118. 

266.67 MHz should be utilized if performing calculation with System Bus 

Speed when encoding is 110B. 

333.33 MHz should be utilized if performing calculation with System Bus 

Speed when encoding is 111B. 
63:3 Reserved. 
Register Address: E7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
See Table 2-2. Unique 
11 SMRR Capability Using MSR OAOH and OA1H (R) Unique 
Register Address: 174H, 372 IA32_SYSENTER_CS 

See Table 2-2. Unique 
Register Address: 175H, 373 IA32_SYSENTER_ESP 

See Table 2-2. Unique 
Register Address: 176H, 374 IA32_SYSENTER_EIP 

See Table 2-2. Unique 
Register Address: 1 79H, 377 IA32_MCG_CAP 

See Table 2-2. Unique 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Unique 


0 


RIPV 
When set, bit indicates that the instruction addressed by the instruction 


pointer pushed on the stack (when the machine check was generated) can be 


used to restart the program. If cleared, the program cannot be reliably 
restarted. 
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Register Address: Hex, Decimal 


Register Name 


IA32_CLOCK_MODULATION MSR was originally named |[A32_THERM_CONTROL MSR. 


Register Address: 19BH, 411 IA32_THERM_INTERRUPT 


Register Information / Bit Fields Bit Description ae 
1 EIPV 
When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) is 
directly associated with the error. 
2 MCIP 
When set, bit indicates that a machine check has been generated. If a second 
machine check is detected while this bit is still set, the processor enters a 
shutdown state. Software should write this bit to O after processing a 
machine check exception. 
63:3 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Unique 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Unique 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. Shared 
Register Address: 198H, 408 MSR_PERF_STATUS 
Current performance status. See Section 15.1.1, “Software Interface For Initiating Performance State Transitions.” Shared 
15:0 Current Performance State Value 
30:16 Reserved. 
31 XE Operation (R/O). 
If set, XE operation is enabled. Default is cleared. 
39:32 Reserved. 
44:40 Maximum Bus Ratio (R/O) 
Indicates maximum bus ratio configured for the processor. 
45 Reserved. 
46 Non-Integer Bus Ratio (R/O) 
Indicates non-integer bus ratio is enabled. Applies processors based on 
Enhanced Intel Core microarchitecture. 
63:47 Reserved. 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Unique 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 
Clock Modulation (R/W) Unique 
See Table 2-2. 


2-70 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description ie 
Thermal Interrupt Control (R/W) Unique 
See Table 2-2. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Unique 
See Table 2-2. 
Register Address: 19DH, 413 MSR_THERM2_CTL 
Thermal Monitor 2 Control Unique 
15:0 Reserved. 
16 TM_SELECT (R/W) 
Mode of automatic thermal monitor: 
Q= Thermal Monitor 1 (thermally-initiated on-die modulation of the stop- 
clock duty cycle). 
1= Thermal Monitor 2 (thermally-initiated frequency transitions). 
If bit 3 of the IA32_MISC_ENABLE register is cleared, TM_SELECT has no 
effect. Neither TM1 nor TM2 are enabled. 
63:16 Reserved. 
Register Address: 1AQH, 416 IA32_MISC_ENABLE 
Enable Misc. Processor Features (R/W) 
Allows a variety of processor functions to be enabled and disabled. 
0 Fast-Strings Enable 
See Table 2-2. 
2:1 Reserved. 
3 Automatic Thermal Control Circuit Enable (R/W) Unique 
See Table 2-2. 
6:4 Reserved. 
Performance Monitoring Available (R) Shared 
See Table 2-2. 
Reserved. 
Hardware Prefetcher Disable (R/W) 
When set, disables the hardware prefetcher operation on streams of data. 
When clear (default), enables the prefetch queue. 
Disabling of the hardware prefetcher may impact processor performance. 
10 FERR# Multiplexing Enable (R/W) Shared 
1 =  FERR# asserted by the processor to indicate a pending break event 
within the processor. 
O= Indicates compatible FERR# signaling behavior. 
This bit must be set to 1 to support XAPIC interrupt model usage. 
11 Branch Trace Storage Unavailable (R/O) Shared 
See Table 2-2. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Shared/ 
Unique 


12 


Processor Event Based Sampling Unavailable (R/O) 
See Table 2-2. 


Shared 


13 


TM2 Enable (R/W) 


When this bit is set (1) and the thermal sensor indicates that the die 
temperature is at the pre-determined threshold, the Thermal Monitor 2 
mechanism is engaged. TM2 will reduce the bus to core ratio and voltage 
according to the value last written to MSR_THERM2_CTL bits 15:0. 

When this bit is clear (0, default), the processor does not change the VID 
signals or the bus to core ratio when the processor enters a thermally 
managed state. 

The BIOS must enable this feature if the TM2 feature flag (CPUID.1:ECX[8)) is 
set; if the TM2 feature flag is not set, this feature is not supported and BIOS 
must not alter the contents of the TM2 bit location. 


The processor is operating out of specification if both this bit and the TM1 bit 
are set to 0. 


Shared 


15:14 


Reserved. 


Enhanced Intel SpeedStep Technology Enable (R/W) 
See Table 2-2. 


Shared 


ENABLE MONITOR FSM (R/W) 
See Table 2-2. 


Shared 


Adjacent Cache Line Prefetch Disable (R/W) 


When set to 1, the processor fetches the cache line that contains data 
currently required by the processor. When set to O, the processor fetches 
cache lines that comprise a cache line pair (128 bytes). 


Single processor platforms should not set this bit. Server platforms should set 
or clear this bit based on platform performance observed in validation and 
testing. 


BIOS may contain a setup option that controls the setting of this bit. 


Shared 


20 


21 


Enhanced Intel SpeedStep Technology Select Lock (R/WO) 

When set, this bit causes the following bits to become read-only: 
* Enhanced Intel SpeedStep Technology Select Lock (this bit). 

« Enhanced Intel SpeedStep Technology Enable bit. 


The bit must be set before an Enhanced Intel SpeedStep Technology 
transition is requested. This bit is cleared on reset. 


Reserved. 


Shared 


22 


Limit CPUID Maxval (R/W) 
See Table 2-2. 


Shared 


23 


XTPR Message Disable (R/W) 
See Table 2-2. 


Shared 


33:24 


Reserved. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ahared 
Unique 
34 XD Bit Disable (R/W) Unique 
When set to 1, the Execute Disable Bit feature (XD Bit) is disabled and the XD 
Bit extended feature flag will be clear (CPUID.80000001H: EDX[20]=0). 
When set to a O (default), the Execute Disable Bit feature (if available) allows 
the OS to enable PAE paging and take advantage of data only pages. 
BIOS must not alter the contents of this bit location if XD bit is not supported. 
Writing this bit to 1 when the XD Bit extended feature flag is set to O may 
generate a #GP exception. 
36:35 Reserved. 
37 DCU Prefetcher Disable (R/W) Unique 
When set to 1, the DCU L1 data cache prefetcher is disabled. The default 
value after reset is 0. BIOS may write ‘1’ to disable this feature. 
The DCU prefetcher is an L1 data cache prefetcher. When the DCU prefetcher 
detects multiple loads from the same line done within a time limit, the DCU 
prefetcher assumes the next line will be required. The next line is prefetched 
in to the L1 data cache from memory or L2. 
38 IDA Disable (R/W) Shared 
When set to 1 on processors that support IDA, the Intel Dynamic Acceleration 
feature (IDA) is disabled and the IDA_Enable feature flag will be cleared 
(CPUID.OGH: EAX[1]=0). 
When set to a O on processors that support IDA, CPUID.OGH: EAX[1] reports 
the processor's support of IDA is enabled. 
Note: The power-on default value is used by BIOS to detect hardware support 
of IDA. If the power-on default value is 1, IDA is available in the processor. If 
the power-on default value is 0, IDA is not available. 
39 IP Prefetcher Disable (R/W) Unique 
When set to 1, the IP prefetcher is disabled. The default value after reset is 0. 
BIOS may write ‘1’ to disable this feature. 
The IP prefetcher is an L1 data cache prefetcher. The IP prefetcher looks for 
sequential load history to determine whether to prefetch the next expected 
data into the L1 cache from memory or L2. 
63:40 Reserved. 
Register Address: 1CSH, 457 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/W) Unique 
Contains an index (bits 0-3) that points to the MSR containing the most recent branch record. 
See MSR_LASTBRANCH_O_FROM_IP (at 40H). 
Register Address: 1D9H, 473 IA32_DEBUGCTL 
Debug Control (R/W) Unique 


See Table 2-2. 


Register Address: 1DDH, 477 


MSR_LER_FROM_LIP 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ae 
Last Exception Record From Linear IP (R/W) Unique 
Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 

Register Address: 1DEH, 478 MSR_LER_TO_LIP 

Last Exception Record To Linear IP (R/W) Unique 
This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 

Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

See Table 2-2. Unique 
Register Address: 201H, 513 IA32_MTRR_PHYSMASKO 

See Table 2-2. Unique 
Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 

See Table 2-2. Unique 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 

See Table 2-2. Unique 
Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 

See Table 2-2. Unique 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 

See Table 2-2. Unique 
Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 

See Table 2-2. Unique 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 

See Table 2-2. Unique 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 

See Table 2-2. Unique 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 

See Table 2-2. Unique 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 

See Table 2-2. Unique 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 

See Table 2-2. Unique 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 

See Table 2-2. Unique 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 

See Table 2-2. Unique 


Register Address: 20EH, 526 


2-74 Vol. 4 


IA32_MTRR_PHYSBASE7 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ie 
See Table 2-2. Unique 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
See Table 2-2. Unique 
Register Address: 250H, 592 1A32_MTRR_FIX64K_00000 
See Table 2-2. Unique 
Register Address: 258H, 600 1A32_MTRR_FIX16K_80000 
See Table 2-2. Unique 
Register Address: 259H, 601 IA32_MTRR_FIX16K_A0000 
See Table 2-2. Unique 
Register Address: 268H, 616 IA32_MTRR_FIX4K_CO000 
See Table 2-2. Unique 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Unique 
Register Address: 26AH, 618 IA32_MTRR_FIX4K_D0000 
See Table 2-2. Unique 
Register Address: 26BH, 619 IA32_MTRR_FIX4K_D8000 
See Table 2-2. Unique 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Unique 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Unique 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
See Table 2-2. Unique 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
See Table 2-2. Unique 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Unique 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Unique 
See Table 2-2. 

Register Address: 309H, 777 IA32_FIXED_CTRO 

Fixed-Function Performance Counter Register O (R/W) Unique 
See Table 2-2. 

Register Address: 30AH, 778 IA32_FIXED_CTR1 

Fixed-Function Performance Counter Register 1 (R/W) Unique 
See Table 2-2. 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description ache 
Register Address: 30BH, 779 IA32_FIXED_CTR2 
Fixed-Function Performance Counter Register 2 (R/W) Unique 
See Table 2-2. 
Register Address: 345H, 837 IA32_PERF_CAPABILITIES 
See Table 2-2. See Section 18.4.1, “IA32_DEBUGCTL MSR.” Unique 
Register Address: 345H, 837 MSR_PERF_CAPABILITIES 
R/O. This applies to processors that do not support architectural perfmon version 2. Unique 
5:0 LBR Format. See Table 2-2. 
6 PEBS Record Format. 
7 PEBSSaveArchRegs. See Table 2-2. 
63:8 Reserved. 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 
Fixed-Function-Counter Control Register (R/W) Unique 
See Table 2-2. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 38€H, 910 MSR_PERF_GLOBAL_STATUS 
See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 38FH, 911 MSR_PERF_GLOBAL_CTRL 
See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 390H, 912 MSR_PERF_GLOBAL_OVF_CTRL 
See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
See Table 2-2. See Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Unique 
0 Enable PEBS on IA32_PMCO. (R/W) 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Unique 
Register Address: 401H, 1025 IA32_MCO_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Unique 
Register Address: 402H, 1026 IA32_MCO_ADDR 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Shared/ 
Unique 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 
The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the 


IA32_MCO_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Unique 


Register Address: 404H, 1028 


IA32_MC1_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Unique 


Register Address: 405H, 1029 


IA32_MC1_STATUS 


See Section 16.3.2.2, “IA32_MCi_STAT 


US MSRS."” 


Unique 


IA32_MC1_ADDR 


Register Address: 406H, 1030 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 
The IA32_MC1_ADDR register is either not implemented or contains no address if the ADDRV flag in the 


IA32_MC1_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Unique 


Register Address: 408H, 1032 


IA32_MC2_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Unique 


Register Address: 409H, 1033 


IA32_MC2_STATUS 


See Section 16.3.2.2, “IA32_MCi_STAT 


US MSRS."” 


Unique 


Register Address: 40AH, 1034 


IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 
The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 


IA32_MC2_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Unique 


Register Address: 40CH, 1036 


IA32_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Unique 


Register Address: 40DH, 1037 


IA32_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STAT 


US MSRS."” 


Unique 


Register Address: 40EH, 1038 


IA32_MC4_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC4_ADDR register is either 
MSR_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


not implemented or contains no address if the ADDRV flag in the 


Unique 


Register Address: 410H, 1040 


IA32_MC3_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Register Address: 411H, 1041 
See Section 16.3.2.2, “IA32_MCi_STAT 


IA32_MC3_STATUS 
US MSRS.” 


Register Address: 412H, 1042 


IA32_MC3_ADDR 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Shared/ 
Unique 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the 


MSR_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Unique 


Register Address: 413H, 1043 


IA32_MC3_MISC 


Machine Check Error Reporting Register: Contains additional information describing the machine-check error if the 


MISCV flag in the I[A32_MCi_STATUS register is set. 


Unique 


Register Address: 414H, 1044 


IA32_MC5_CTL 


Machine Check Error Reporting Register: Controls signaling of #MC for errors produced by a particular hardware unit 


(or group of hardware units). 
Register Address: 415H, 1045 


IA32_MC5_STATUS 


Unique 


Machine Check Error Reporting Register: Contains information related to a machine-check error if its VAL (valid) flag is 
set. Software is responsible for clearing [A32_MCi_STATUS MSRs by explicitly writing Os to them; writing 1s to them 


causes a general-protection exception 
Register Address: 416H, 1046 


IA32_MC5_ADDR 


Unique 


Machine Check Error Reporting Register: Contains the address of the code or data memory location that produced the 


machine-check error if the ADDRV flag in the [A32_MCi_STATUS register is set. 


Unique 


Register Address: 41 7H, 1047 


IA32_MC5_MISC 


Machine Check Error Reporting Register: Contains additional information describing the machine-check error if the 


MISCV flag in the IA32_MCi_STATUS register is set. 


Unique 


Register Address: 419H, 1045 


Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 16.3.2.2, 


IA32_MC6_STATUS 


“IA32_MCi_STATUS MSRS," and Chapter 24. 


Unique 


Register Address: 480H, 1152 


IA32_VMX_BASIC 


Reporting Register of Basic VMX Capabilities (R/O) 
See Table 2-2. See Appendix A.1, “Basic VMX Information.” 


Register Address: 481H, 1153 


IA32_VMX_PINBASED_CTLS 


Unique 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) 


See Table 2-2. See Appendix A.3, “VM- 


Execution Controls.” 


Unique 


Register Address: 482H, 1154 


IA32_WMX_PROCBASED_CTLS 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) 
See Appendix A.3, “VM-Execution Controls.” 


Unique 


Register Address: 483H, 1155 


IA32_VMX_EXIT_CTLS 


Capability Reporting Register of VM-Exit Controls (R/O) 


See Table 2-2. See Appendix A.4, "“VM- 
Register Address: 484H, 1156 


Exit Controls.” 
IA32_VMX_ENTRY_CTLS 


Unique 


Capability Reporting Register of VM-Entry Controls (R/O) 


See Table 2-2. See Appendix A.5, “VM- 


Entry Controls.” 


Unique 


Register Address: 485H, 1157 


IA32_VMX_MISC 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Shared/ 
Unique 


Reporting Register of Miscellaneous VMX Capabilities (R/O) 
See Table 2-2. See Appendix A.6, “Miscellaneous Data.” 


Unique 


Register Address: 486H, 1158 


IA32_WMX_CRO_FIXEDO 


Capability Reporting Register of CRO B 


its Fixed to 0 (R/O) 


See Table 2-2. See Appendix A.7, “VMX-Fixed Bits in CRO.” 


Unique 


Register Address: 487H, 1159 


IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO B 


its Fixed to 1 (R/O) 


See Table 2-2. See Appendix A.7, “VMX-Fixed Bits in CRO.” 


Unique 


Register Address: 488H, 1160 


IA32_WVMX_CR4_FIXEDO 


Capability Reporting Register of CR4 B 


its Fixed to 0 (R/O) 


See Table 2-2. See Appendix A.8, “VMX-Fixed Bits in CR4.” 


Unique 


Register Address: 489H, 1161 


IA32_WMX_CR4_FIXED1 


Capability Reporting Register of CR4 B 


its Fixed to 1 (R/O) 


See Table 2-2. See Appendix A.8, “VMX-Fixed Bits in CR4.” 


Unique 


Register Address: 48AH, 1162 


IA32_VWMX_VMCS_ENUM 


Capability Reporting Register of VMCS 


Field Enumeration (R/O) 


See Table 2-2. See Appendix A.9, “VMCS Enumeration.” 


Unique 


Register Address: 48BH, 1163 


IA32_WMX_PROCBASED_CTLS2 


Capability Reporting Register of Secon 


dary Processor-Based VM-Execution Controls (R/O) 


See Appendix A.3, “VM-Execution Controls.” 


Unique 


Register Address: 600H, 1536 


IA32_DS_AREA 


DS Save Area (R/W) 


See Table 2-2. See Section 20.6.3.4, “Debug Store (DS) Mechanism." 


Register Address: 107CCH, 67532 


MSR_EMON_L3_CTR_CTLO 


Unique 


GBUSQ Event Control/Counter Register (R/W) 


Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 


Unique 


Register Address: 107CDH, 67533 


MSR_EMON_L3_CTR_CTL1 


GBUSQ Event Control/Counter Register (R/W) 


Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 


Unique 


Register Address: 107CEH, 67534 


MSR_EMON_L3_CTR_CTL2 


GSNPQ Event Control/Counter Register (R/W) 


Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 


Unique 


Register Address: 107CFH, 67535 


MSR_EMON_L3_CTR_CTL3 


GSNPQ Event Control/Counter Register (R/W) 


Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 


Unique 


Register Address: 107DOH, 67536 


MSR_EMON_L3_CTR_CTL4 
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Table 2-3. MSRs in Processors Based on Intel® Core™ Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ae 
FSB Event Control/Counter Register (R/W) Unique 
Applies to Intel Xeon processor 7400 series (processor signature O06_1D) only. See Section 18.2.2. 

Register Address: 107D1H, 67537 MSR_EMON_L3_CTR_CTL5 

FSB Event Control/Counter Register (R/W) Unique 
Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 

Register Address: 107D2H, 67538 MSR_EMON_L3_CTR_CTL6 

FSB Event Control/Counter Register (R/W) Unique 
Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 

Register Address: 107D3H, 67539 MSR_EMON_L3_CTR_CTL7 

FSB Event Control/Counter Register (R/W) Unique 
Applies to Intel Xeon processor 7400 series (processor signature O6_1D) only. See Section 18.2.2. 

Register Address: 107D8H, 67544 MSR_EMON_L3_GL_CTL 

L3/FSB Common Control Register (R/W) Unique 
Applies to Intel Xeon processor 7400 series (processor signature 06_1D) only. See Section 18.2.2. 

Register Address: COOO_O080H IA32_EFER 

Extended Feature Enables Unique 
See Table 2-2. 

Register Address: COO0_0081H IA32_STAR 

System Call Target Address (R/W) Unique 
See Table 2-2. 

Register Address: COOO0_0082H IA32_LSTAR 

IA-32e Mode System Call Target Address (R/W) Unique 
See Table 2-2. 

Register Address: COOO0_0084H IA32_FMASK 

System Call Flag Mask (R/W) Unique 
See Table 2-2. 

Register Address: COO00_0100H IA32_FS_BASE 

Map of BASE Address of FS (R/W) Unique 
See Table 2-2. 

Register Address: CO00_0101H IA32_GS_BASE 

Map of BASE Address of GS (R/W) Unique 
See Table 2-2. 

Register Address: CO00_0102H IA32_KERNEL_GS_BASE 

Swap Target of BASE Address of GS (R/W) Unique 


See Table 2-2. 
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2:4 MSRS IN THE 45 NM AND 32 NM INTEL ATOM® PROCESSOR FAMILY 


Table 2-4 lists model-specific registers (MSRs) for 45 nm and 32 nm Intel Atom processors, architectural MSR 
addresses are also included in Table 2-4. These processors have a CPUID Signature DisplayFamily_DisplayModel 
value of 06_1CH, 06_26H, 06_27H, 06_35H, or 06_36H; see Table 2-1. 


The column “Shared/Unique” applies to logical processors sharing the same core in processors based on the Intel 
Atom microarchitecture. “Unique” means each logical processor has a separate MSR, or a bit field in an MSR 
governs only a logical processor. “Shared” means the MSR or the bit field in an MSR address governs the operation 
of both logical processors in the same core. 


Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description ae 
Register Address: OH, 0 IA32_P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors." Shared 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors." Shared 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Unique 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and see Table 2-2. Unique 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Shared 
See Table 2-2. 
Register Address: 17H, 23 MSR_PLATFORM_ID 
Model Specific Platform ID (R) Shared 
7:0 Reserved. 
12:8 Maximum Qualified Ratio (R) 
The maximum allowed bus ratio. 
63:13 Reserved. 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Unique 
Register Address: 2AH, 42 MSR_EBL_CR_POWERON 
Processor Hard Power-On Configuration (R/W) Shared 
Enables and disables processor features; (R) indicates current processor configuration. 
0 Reserved. 
1 Data Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Always 0. 
2 Response Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Always 0. 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


* Section 18.5. 


One of eight pairs of last branch record registers on the last branch record stack. The From_IP part of the stack 
contains pointers to the source instruction. See also: 


« Last Branch Record Stack TOS at 1C9H. 


Register Information / Bit Fields Bit Description ae 
3 AERR# Drive Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Always 0. 
4 BERR# Enable for initiator bus requests (R/W) 
1 = Enabled; 0 = Disabled. 
Always 0. 
Reserved. 
Reserved. 
BINIT# Driver Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Always 0. 
Reserved. 
Execute BIST (R/O) 
1 = Enabled; 0 = Disabled. 
10 AERR# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
Always 0. 
11 Reserved. 
12 BINIT# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
Always 0. 
13 Reserved. 
14 1 MByte Power on Reset Vector (R/O) 
1 = 1 MByte; O = 4 GBytes. 
15 Reserved. 
17:16 APIC Cluster ID (R/O) 
Always OOB. 
19:18 Reserved. 
21:20 Symmetric Arbitration ID (R/O) 
Always OOB. 
26:22 Integer Bus Frequency Ratio (R/O) 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64Processor (R/W) Unique 
See Table 2-2. 
Register Address: 40H, 64 MSR_LASTBRANCH_O_FROM_IP 
Last Branch Record 0 From IP (R/W) Unique 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See description of MSR_LASTBRANCH_O_FROM_IP. 


Register Information / Bit Fields Bit Description Tae 

Register Address: 41H, 65 MSR_LASTBRANCH_1_FROM_IP 

Last Branch Record 1 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 42H, 66 MSR_LASTBRANCH_2_FROM_IP 

Last Branch Record 2 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 43H, 67 MSR_LASTBRANCH_3_FROM_IP 

Last Branch Record 3 From IP (R/W) Unique 


Register Address: 44H, 68 MSR_LASTBRANCH_4_FROM_IP 


pointers to the destination instruction. 


One of eight pairs of last branch record registers on the last branch record stack. The To_IP part of the stack contains 


Last Branch Record 4 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 45H, 69 MSR_LASTBRANCH_5_FROM_IP 

Last Branch Record 5 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 46H, 70 MSR_LASTBRANCH_6_FROM_IP 

Last Branch Record 6 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 47H, 71 MSR_LASTBRANCH_7_FROM_IP 

Last Branch Record 7 From IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 60H, 96 MSR_LASTBRANCH_O_TO_IP 

Last Branch Record 0 To IP (R/W) Unique 


Register Address: 61H, 97 MSR_LASTBRANCH_1_TO_IP 


See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 65H, 101 


Last Branch Record 1 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 62H, 98 MSR_LASTBRANCH_2_TO_IP 

Last Branch Record 2 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 63H, 99 MSR_LASTBRANCH_3_TO_IP 

Last Branch Record 3 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 64H, 100 MSR_LASTBRANCH_4_TO_IP 

Last Branch Record 4 To IP (R/W) Unique 


MSR_LASTBRANCH_5_TO_IP 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description ae 
Last Branch Record 5 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 66H, 102 MSR_LASTBRANCH_6_TO_IP 
Last Branch Record 6 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 67H, 103 MSR_LASTBRANCH_7_TO_IP 
Last Branch Record 7 To IP (R/W) Unique 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 79H, 121 IA32_BlOS_UPDT_TRIG 
BIOS Update Trigger Register (W) Shared 
See Table 2-2. 
Register Address: 8BH, 139 IA32_BIOS_SIGN_ID 
BIOS Update Signature ID (R/W) Unique 
See Table 2-2. 
Register Address: C1H, 193 IA32_PMCO 
Performance counter register Unique 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Unique 
See Table 2-2. 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Shared 
This field indicates the intended scalable bus clock speed for processors based on Intel Atom microarchitecture. 
2:0 = 111B: 083 MHz (FSB 333) 
* 101B: 100 MHz (FSB 400) 
* 001B: 133 MHz (FSB 533) 
* 011B: 167 MHz (FSB 667) 
133.33 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is 001B. 
166.67 MHz should be utilized if performing calculation with System Bus 
Speed when encoding is 0118B. 
63:3 Reserved. 
Register Address: E7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description ae 
Memory Type Range Register (R) Shared 
See Table 2-2. 

Register Address: 11€H, 281 MSR_BBL_CR_CTL3 
Control Register 3 Shared 
Used to configure the L2 Cache. 
0 L2 Hardware Enabled (R/O) 
1= Indicates the L2 is hardware-enabled. 
O= Indicates the L2 is hardware-disabled. 
7:1 Reserved. 
L2 Enabled (R/W) 
1 =  L2 cache has been initialized. 
O= Disabled (default). 
Until this bit is set, the processor will not respond to the WBINVD instruction 
or the assertion of the FLUSH# input. 
22:9 Reserved. 
23 L2 Not Present (R/O) 
O= L2 Present. 
1=  L2 Not Present. 
63:24 Reserved. 
Register Address: 174H, 372 IA32_SYSENTER_CS 
See Table 2-2. Unique 
Register Address: 175H, 373 IA32_SYSENTER_ESP 
See Table 2-2. Unique 
Register Address: 176H, 374 IA32_SYSENTER_EIP 
See Table 2-2. Unique 
Register Address: 1 79H, 377 IA32_MCG_CAP 
See Table 2-2. Unique 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Unique 


0 


RIPV 


When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) can be 
used to restart the program. If cleared, the program cannot be reliably 
restarted. 


EIPV 

When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) is 
directly associated with the error. 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description ae 
2 MCIP 
When set, bit indicates that a machine check has been generated. If a second 
machine check is detected while this bit is still set, the processor enters a 
shutdown state. Software should write this bit to O after processing a 
machine check exception. 
63:3 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Unique 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Unique 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. Shared 
Register Address: 198H, 408 MSR_PERF_STATUS 
Performance Status Shared 
15:0 Current Performance State Value. 
39:16 Reserved. 
44:40 Maximum Bus Ratio (R/O) 
Indicates maximum bus ratio configured for the processor. 
63:45 Reserved. 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Unique 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 
Clock Modulation (R/W) Unique 
See Table 2-2. 
1A32_CLOCK_MODULATION MSR was originally named |[A32_THERM_CONTROL MSR. 
Register Address: 19BH, 411 IA32_THERM_INTERRUPT 
Thermal Interrupt Control (R/W) Unique 
See Table 2-2. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Unique 
See Table 2-2. 
Register Address: 19DH, 413 MSR_THERM2_CTL 
Thermal Monitor 2 Control Shared 
15:0 Reserved. 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description tae 
16 TM_SELECT (R/W) 
Mode of automatic thermal monitor: 
O= Thermal Monitor 1 (thermally-initiated on-die modulation of the stop- 
clock duty cycle). 
1= Thermal Monitor 2 (thermally-initiated frequency transitions). 
If bit 3 of the [A32_MISC_ENABLE register is cleared, TM_SELECT has no 
effect. Neither TM1 nor TM2 are enabled. 
63:17 Reserved. 
Register Address: 1AQH, 416 IA32_MISC_ENABLE 
Enable Misc. Processor Features (R/W) Unique 
Allows a variety of processor functions to be enabled and disabled. 
0 Fast-Strings Enable 
See Table 2-2. 
2:1 Reserved. 
3 Automatic Thermal Control Circuit Enable (R/W) Unique 
See Table 2-2. Default value is 0. 
6:4 Reserved. 
Performance Monitoring Available (R) Shared 
See Table 2-2. 
Reserved. 
Reserved. 
10 FERR# Multiplexing Enable (R/W) Shared 
1 =  FERR# asserted by the processor to indicate a pending break event 
within the processor. 
O= Indicates compatible FERR# signaling behavior. 
This bit must be set to 1 to support XAPIC interrupt model usage. 
11 Branch Trace Storage Unavailable (R/O) Shared 
See Table 2-2. 
12 Processor Event Based Sampling Unavailable (R/O) Shared 
See Table 2-2. 
13 TM2 Enable (R/W) Shared 


When this bit is set (1) and the thermal sensor indicates that the die 
temperature is at the pre-determined threshold, the Thermal Monitor 2 
mechanism is engaged. TM2 will reduce the bus to core ratio and voltage 
according to the value last written to MSR_THERM2_CTL bits 15:0. 

When this bit is cleared (0, default), the processor does not change the VID 
signals or the bus to core ratio when the processor enters a thermally 
managed state. 

The BIOS must enable this feature if the TM2 feature flag (CPUID.1:ECX[8]) is 
set; if the TM2 feature flag is not set, this feature is not supported and BIOS 
must not alter the contents of the TM2 bit location. 

The processor is operating out of specification if both this bit and the TM1 bit 
are Set to 0. 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 


Register Address: 1DEH, 478 MSR_LER_TO_LIP 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description ae 

15:14 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) Shared 
See Table 2-2. 

18 ENABLE MONITOR FSM (R/W) Shared 
See Table 2-2. 

19 Reserved. 

20 Enhanced Intel SpeedStep Technology Select Lock (R/WO) Shared 
When set, this bit causes the following bits to become read-only: 
* €nhanced Intel SpeedStep Technology Select Lock (this bit). 
« Enhanced Intel SpeedStep Technology Enable bit. 
The bit must be set before an Enhanced Intel SpeedStep Technology transition 
is requested. This bit is cleared on reset. 

21 Reserved. 

22 Limit CPUID Maxval (R/W) Unique 
See Table 2-2. 

23 xTPR Message Disable (R/W) Shared 
See Table 2-2. 

33:24 Reserved. 

34 XD Bit Disable (R/W) Unique 
See Table 2-3. 

63:35 Reserved. 

Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 

Last Branch Record Stack TOS (R/W) Unique 

Contains an index (bits 0-2) that points to the MSR containing the most recent branch record. 

See MSR_LASTBRANCH_O_FROM_IP (at 40H). 

Register Address: 1D9H, 473 IA32_DEBUGCTL 

Debug Control (R/W) Unique 

See Table 2-2. 

Register Address: 1DDH, 477 MSR_LER_FROM_LIP 

Last Exception Record From Linear IP (R) Unique 


Last Exception Record To Linear IP (R) Unique 
This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 

Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

See Table 2-2. Shared 


Register Address: 201H, 513 


IA32_MTRR_PHYSMASKO 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description ae 
See Table 2-2. Shared 
Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 
See Table 2-2. Shared 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 
See Table 2-2. Shared 
Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 
See Table 2-2. Shared 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 
See Table 2-2. Shared 
Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 
See Table 2-2. Shared 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 
See Table 2-2. Shared 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 
See Table 2-2. Shared 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 
See Table 2-2. Shared 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 
See Table 2-2. Shared 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 
See Table 2-2. Shared 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 
See Table 2-2. Shared 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 
See Table 2-2. Shared 
Register Address: 20EH, 526 IA32_MTRR_PHYSBASE7 
See Table 2-2. Shared 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
See Table 2-2. Shared 
Register Address: 250H, 592 1A32_MTRR_FIX64K_00000 
See Table 2-2. Shared 
Register Address: 258H, 600 1A32_MTRR_FIX16K_80000 
See Table 2-2. Shared 
Register Address: 259H, 601 IA32_MTRR_FIX16K_A0000 
See Table 2-2. Shared 
Register Address: 268H, 616 IA32_MTRR_FIX4K_CO000 
See Table 2-2. Shared 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description ae 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Shared 
Register Address: 26AH, 618 IA32_MTRR_FIX4K_D0000 
See Table 2-2. Shared 
Register Address: 26BH, 619 IA32_MTRR_FIX4K_D8000 
See Table 2-2. Shared 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Shared 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Shared 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
See Table 2-2. Shared 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
See Table 2-2. Shared 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Unique 
Register Address: 309H, 777 IA32_FIXED_CTRO 
Fixed-Function Performance Counter Register O (R/W) Unique 
See Table 2-2. 
Register Address: 30AH, 778 IA32_FIXED_CTR1 
Fixed-Function Performance Counter Register 1 (R/W) Unique 
See Table 2-2. 
Register Address: 30BH, 779 IA32_FIXED_CTR2 
Fixed-Function Performance Counter Register 2 (R/W) Unique 
See Table 2-2. 
Register Address: 345H, 837 IA32_PERF_CAPABILITIES 
See Table 2-2. See Section 18.4.1, “IA32_DEBUGCTL MSR.” Shared 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 
Fixed-Function-Counter Control Register (R/W) Unique 
See Table 2-2. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Unique 


Register Address: 3F1H, 1009 


IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Shared/ 


Register Information / Bit Fields Bit Description : 
Unique 


See Table 2-2. See Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Unique 


0 Enable PEBS on IA32_PMCO (R/W) 


Register Address: 400H, 1024 IA32_MCO_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Shared 


Register Address: 401H, 1025 IA32_MCO_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Shared 


Register Address: 402H, 1026 IA32_MCO_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Shared 


The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MCO_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 404H, 1028 IA32_MC1_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Shared 


Register Address: 405H, 1029 IA32_MC1_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Shared 


Register Address: 408H, 1032 IA32_MC2_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Shared 


Register Address: 409H, 1033 IA32_MC2_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Shared 


Register Address: 40AH, 1034 IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Shared 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC2_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 40CH, 1036 IA32_MC3_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Shared 


Register Address: 40DH, 1037 IA32_MC3_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Shared 
Register Address: 40EH, 1038 IA32_MC3_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Shared 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 410H, 1040 IA32_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Shared 
Register Address: 411H, 1041 IA32_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Shared 


Register Address: 412H, 1042 IA32_MC4_ADDR 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Shared/ 


Register Information / Bit Fields Bit Description : 
Unique 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Shared 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 480H, 1152 IA32_VMX_BASIC 


Reporting Register of Basic VMX Capabilities (R/O) Unique 
See Table 2-2. See Appendix A.1, “Basic VMX Information.” 


Register Address: 481H, 1153 IA32_VMX_PINBASED_CTLS 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) Unique 
See Table 2-2. See Appendix A.3, “VM-Execution Controls.” 


Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) Unique 
See Appendix A.3, “VM-Execution Controls.” 


Register Address: 483H, 1155 IA32_VMX_EXIT_CTLS 


Capability Reporting Register of VM-Exit Controls (R/O) Unique 
See Table 2-2. See Appendix A.4, “VM-Exit Controls.” 


Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 


Capability Reporting Register of VM-Entry Controls (R/O) Unique 
See Table 2-2. See Appendix A.5, “VM-Entry Controls.” 


Register Address: 485H, 1157 IA32_VMX_MISC 


Reporting Register of Miscellaneous VMX Capabilities (R/O) Unique 
See Table 2-2. See Appendix A.6, “Miscellaneous Data.” 


Register Address: 486H, 1158 IA32_WMX_CRO_FIXEDO 


Capability Reporting Register of CRO Bits Fixed to O (R/O) Unique 
See Table 2-2. See Appendix A.7, “VMX-Fixed Bits in CRO.” 


Register Address: 487H, 1159 IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO Bits Fixed to 1 (R/O) Unique 
See Table 2-2. See Appendix A.7, “VMX-Fixed Bits in CRO.” 


Register Address: 488H, 1160 IA32_WVMX_CR4_FIXEDO 


Capability Reporting Register of CR4 Bits Fixed to 0 (R/O) Unique 
See Table 2-2. See Appendix A.8, “VMX-Fixed Bits in CR4.” 


Register Address: 489H, 1161 IA32_WMX_CR4_FIXED1 


Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) Unique 
See Table 2-2. See Appendix A.8, “VMX-Fixed Bits in CR4.” 


Register Address: 48AH, 1162 IA32_WMX_VMCS_ENUM 


Capability Reporting Register of VMCS Field Enumeration (R/O) Unique 
See Table 2-2. See Appendix A.9, “VMCS Enumeration.” 


Register Address: 48BH, 1163 IA32_WMX_PROCBASED_CTLS2 
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Table 2-4. MSRs in the 45 nm and 32 nm Intel Atom® Processor Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


See Table 2-2. 


Register Information / Bit Fields Bit Description Tae 
Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) Unique 
See Appendix A.3, “VM-Execution Controls.” 

Register Address: 600H, 1536 IA32_DS_AREA 

DS Save Area (R/W) Unique 
See Table 2-2. See Section 20.6.3.4, “Debug Store (DS) Mechanism." 

Register Address: COOO_O080H IA32_EFER 

Extended Feature Enables Unique 
See Table 2-2. 

Register Address: COO0_0081H IA32_STAR 

System Call Target Address (R/W) Unique 


Register Address: COOO_O0082H IA32_LSTAR 


See Table 2-2. 


IA-32e Mode System Call Target Address (R/W) Unique 
See Table 2-2. 

Register Address: COOO0_0084H IA32_FMASK 

System Call Flag Mask (R/W) Unique 
See Table 2-2. 

Register Address: COO00_0100H IA32_FS_BASE 

Map of BASE Address of FS (R/W) Unique 


Map of BASE Address of GS (R/W) 
See Table 2-2. 


Register Address: COO0_0101H IA32_GS_BASE 
Register Address: CO00_0102H IA32_KERNEL_GS_BASE 


Unique 


Swap Target of BASE Address of GS (R/W) 
See Table 2-2. 


Unique 


Table 2-5 lists model-specific registers (MSRs) that are specific to Intel Atom® processor with a CPUID Signature 


DisplayFamily_DisplayModel value of 06_27H. 


Table 2-5. MSRs Supported by Intel Atom® Processors with a CPUID Signature DisplayFamily_DisplayModel 


Value of 06_27H 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


Register Information / Bit Fields Bit Description Scope 
Register Address: 3F8H, 1016 MSR_PKG_C2_RESIDENCY 
Package C2 Residency Package 
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Table 2-5. MSRs Supported by Intel Atom® Processors (Contd.)with a CPUID Signature DisplayFamily_DisplayModel 
Value of 06_27H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
63:0 Package C2 Residency Counter (R/O) Package 


Time that this package is in processor-specific C2 states since last reset. 
Counts at 1 Mhz frequency. 


Register Address: 3F9H, 1017 MSR_PKG_C4_RESIDENCY 


Package C4 Residency Package 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


63:0 Package C4 Residency Counter. (R/O) Package 


Time that this package is in processor-specific C4 states since last reset. 
Counts at 1 Mhz frequency. 


Register Address: 3FAH, 1018 MSR_PKG_C6_RESIDENCY 


Package C6 Residency Package 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


63:0 Package C6 Residency Counter. (R/O) Package 


Time that this package is in processor-specific C6 states since last reset. 
Counts at 1 Mhz frequency. 


2.4 MSRS IN INTEL PROCESSORS BASED ON SILVERMONT 
MICROARCHITECTURE 


Table 2-6 lists model-specific registers (MSRs) common to Intel processors based on the Silvermont microarchitec- 
ture. These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_37H, 06_4AH, 06_4DH, 
06_5AH, or 06_5DH; see Table 2-1. The MSRs listed in Table 2-6 are also common to processors based on the 
Airmont microarchitecture and newer microarchitectures for next generation Intel Atom processors. 


Table 2-7 lists MSRs common to processors based on the Silvermont and Airmont microarchitectures, but not 
newer microarchitectures. 


Table 2-8, Table 2-9, and Table 2-10 lists MSRs that are model-specific across processors based on the Silvermont 
microarchitecture. 


In the Silvermont microarchitecture, the scope column indicates the following: “Core” means each processor core 
has a separate MSR, or a bit field not shared with another processor core. “Module” means the MSR or the bit field 
is shared by a subset of the processor cores in the physical package. The number of processor cores in this subset 
is model specific and may differ between different processors. For all processors based on Silvermont microarchi- 
tecture, the L2 cache is also shared between cores in a module and thus CPUID leaf 04H enumeration can be used 
to figure out which processors are in the same module. “Package” means all processor cores in the physical 
package share the same MSR or bit interface. 


Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: OH, O IA32_P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors." Module 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Section 2.23, "MSRs in Pentium Processors.” Module 
Register Address: 6H, 6 1A32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Core 
Register Address: 10H, 16 1A32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and Table 2-2. Core 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Core 
Register Address: 2AH, 42 MSR_EBL_CR_POWERON 
Processor Hard Power-On Configuration (R/W) Module 
Writes ignored. 

63:0 Reserved. 
Register Address: 34H, 52 MSR_SMI_COUNT 
SMI Counter (R/O) Core 
31:0 SMI Count (R/O) 
Running count of SMI events since last RESET. 
63:32 Reserved. 
Register Address: 79H, 121 IA32_BIOS_UPDT_TRIG 
BIOS Update Trigger Register (W) Core 
See Table 2-2. 
Register Address: 8BH, 139 IA32_BlOS_SIGN_ID 
BIOS Update Signature ID (R/W) Core 
See Table 2-2. 
Register Address: C1H, 193 IA32_PMCO 
Performance Counter Register Core 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Core 
See Table 2-2. 
Register Address: E4H, 228 MSR_PMG_IO_CAPTURE_BASE 
Power Management IO Redirection in C-state (R/W) Module 
See http://biosbits.org. 
15:0 LVL_2 Base Address (R/W) 
Specifies the base address visible to software for IO redirection. If |O MWAIT 
Redirection is enabled, reads to this address will be consumed by the power 
management logic and decoded to MWAIT instructions. When |O port 
address redirection is enabled, this is the lO port address reported to the 
OS/software. 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
18:16 C-state Range (R/W) 
Specifies the encoding value of the maximum C-State code name to be 
included when IO read to MWAIT redirection is enabled by 
MSR_PKG_CST_CONFIG_CONTROL[bit1 0}: 
100b - C4 is the max C-State to include 
110b - C6 is the max C-State to include 
111b - C7 is the max C-State to include 
63:19 Reserved. 
Register Address: E7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Core 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Core 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
Memory Type Range Register (R) Core 
See Table 2-2. 
Register Address: 13CH, 316 MSR_FEATURE_CONFIG 
AES Configuration (RW-L) Core 
Privileged post-BIOS agent must provide a #GP handler to handle unsuccessful read of this MSR. 
1:0 AES Configuration (RW-L) 
Upon a successful read of this MSR, the configuration of AES instruction 
sets availability is as follows: 
11b: AES instructions are not available until next RESET. 
Otherwise, AES instructions are available. 
Note: AES instruction set is not available if read is unsuccessful. If the 
configuration is not 01b, AES instructions can be mis-configured if a 
privileged agent unintentionally writes 11b. 
63:2 Reserved. 
Register Address: 174H, 372 IA32_SYSENTER_CS 
See Table 2-2. Core 
Register Address: 175H, 373 IA32_SYSENTER_ESP 
See Table 2-2. Core 
Register Address: 176H, 374 IA32_SYSENTER_EIP 
See Table 2-2. Core 
Register Address: 179H, 377 IA32_MCG_CAP 
See Table 2-2. Core 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Core 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
0 RIPV 
When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) can 
be used to restart the program. If cleared, the program cannot be reliably 
restarted. 
1 EIPV 
When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) is 
directly associated with the error. 
2 MCIP 
When set, bit indicates that a machine check has been generated. If a 
second machine check is detected while this bit is still set, the processor 
enters a shutdown state. Software should write this bit to 0 after 
processing a machine check exception. 
63:3 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Core 
7:0 Event Select 
15:8 UMask 
16 USR 
17 e)s) 
18 Edge 
19 PC 
20 INT 
21 Reserved. 
22 EN 
23 INV 
31:24 CMASK 
63:32 Reserved. 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Core 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. Module 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Core 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 
Clock Modulation (R/W) Core 
See Table 2-2. 
IA32_CLOCK_MODULATION MSR was originally named [A32_THERM_CONTROL MSR. 


Register Address: 19BH, 411 IA32_THERM_INTERRUPT 
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Table 2-6. MSRs Common to Intel Atom’ Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


Thermal Interrupt Control (R/W) Core 
See Table 2-2. 

Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Core 
See Table 2-2. 

Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Package 
15:0 Reserved. 

23:16 Temperature Target (R) 


The default thermal throttling or PROCHOT# activation temperature in 
degrees C. The effective temperature for thermal throttling or PROCHOT# 
activation is “Temperature Target” + “Target Offset”. 


29:24 Target Offset (R/W) 


Specifies an offset in degrees C to adjust the throttling and PROCHOT# 
activation temperature from the default target specified in 
TEMPERATURE_TARGET (bits 23:16). 


63:30 Reserved. 

Register Address: 1A6H, 422 MSR_OFFCORE_RSP_O 

Offcore Response Event Select Register (R/W) Module 
Register Address: 1A7H, 423 MSR_OFFCORE_RSP_1 

Offcore Response Event Select Register (R/W) Module 
Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 

See Table 2-2. Core 
Register Address: 1D9H, 473 IA32_DEBUGCTL 

Debug Control (R/W) Core 
See Table 2-2. 

Register Address: 1DDH, 477 MSR_LER_FROM_LIP 

Last Exception Record From Linear IP (R/W) Core 


Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 


Register Address: 1DEH, 478 MSR_LER_TO_LIP 


Last Exception Record To Linear IP (R/W) Core 


This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 


Register Address: 1F2H, 498 IA32_SMRR_PHYSBASE 

See Table 2-2. Core 
Register Address: 1F3H, 499 IA32_SMRR_PHYSMASK 

See Table 2-2. Core 
Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

See Table 2-2. Core 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 201H, 513 IA32_MTRR_PHYSMASKO 
See Table 2-2. Core 
Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 
See Table 2-2. Core 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 
See Table 2-2. Core 
Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 
See Table 2-2. Core 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 
See Table 2-2. Core 
Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 
See Table 2-2. Core 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 
See Table 2-2. Core 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 
See Table 2-2. Core 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 
See Table 2-2. Core 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 
See Table 2-2. Core 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 
See Table 2-2. Core 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 
See Table 2-2. Core 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 
See Table 2-2. Core 
Register Address: 20€H, 526 IA32_MTRR_PHYSBASE7 
See Table 2-2. Core 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
See Table 2-2. Core 
Register Address: 250H, 592 IA32_MTRR_FIX64K_00000 
See Table 2-2. Core 
Register Address: 258H, 600 IA32_MTRR_FIX16K_80000 
See Table 2-2. Core 
Register Address: 259H, 601 IA32_MTRR_FIX16K_A0000 
See Table 2-2. Core 


Register Address: 268H, 616 


IA32_MTRR_FIX4K_COO00 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
See Table 2-2. Core 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Core 
Register Address: 26AH, 618 1A32_MTRR_FIX4K_D0000 
See Table 2-2. Core 
Register Address: 26BH, 619 1A32_MTRR_FIX4K_D8000 
See Table 2-2. Core 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Core 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Core 
Register Address: 26€H, 622 1A32_MTRR_FIX4K_FOO00 
See Table 2-2. Core 
Register Address: 26FH, 623 1A32_MTRR_FIX4K_F8000 
See Table 2-2. Core 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Core 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Core 
See Table 2-2. 

Register Address: 309H, 777 IA32_FIXED_CTRO 

Fixed-Function Performance Counter Register O (R/W) Core 
See Table 2-2. 

Register Address: 30AH, 778 IA32_FIXED_CTR1 

Fixed-Function Performance Counter Register 1 (R/W) Core 
See Table 2-2. 

Register Address: 30BH, 779 IA32_FIXED_CTR2 

Fixed-Function Performance Counter Register 2 (R/W) Core 
See Table 2-2. 

Register Address: 345H, 837 IA32_PERF_CAPABILITIES 

See Table 2-2. See Section 18.4.1, “IA32_DEBUGCTL MSR.” Core 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 

Fixed-Function-Counter Control Register (R/W) Core 
See Table 2-2. 

Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 

See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Core 


Register Address: 3FDH, 1021 


MSR_CORE_C6_RESIDENCY 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description 


Scope 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


Core 


63:0 CORE C6 Residency Counter (R/O) 


Value since last reset that this core is in processor-specific C6 states. 
Counts at the TSC Frequency. 


Register Address: 400H, 1024 IA32_MCO_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Module 


Register Address: 401H, 1025 IA32_MCO_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Module 


Register Address: 402H, 1026 IA32_MCO_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MCO_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Module 


Register Address: 404H, 1028 IA32_MC1_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Module 


Register Address: 405H, 1029 IA32_MC1_STATUS 


See Section 16.3.2.2, “[A32_MCi_STATUS MSRS." 
Register Address: 408H, 1032 IA32_MC2_CTL 


Module 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Module 


Register Address: 409H, 1033 IA32_MC2_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Module 


Register Address: 40AH, 1034 IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC2_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Module 


Register Address: 40CH, 1036 IA32_MC3_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Core 


Register Address: 40DH, 1037 IA32_MC3_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Core 


Register Address: 40EH, 1038 IA32_MC3_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Core 


Register Address: 410H, 1040 IA32_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Core 


Register Address: 411H, 1041 IA32_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Core 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 412H, 1042 IA32_MC4_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 414H, 1044 IA32_MC5_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 415H, 1045 IA32_MC5_STATUS 

See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Package 
Register Address: 416H, 1046 IA32_MC5_ADDR 

See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 
Register Address: 480H, 1152 IA32_VMX_BASIC 

Reporting Register of Basic VMX Capabilities (R/O) Core 
See Table 2-2. 

See Appendix A.1, “Basic VMX Information.” 

Register Address: 481H, 1153 IA32_VMX_PINBASED_CTLS 
Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) Core 
See Table 2-2. 

See Appendix A.3, “VM-Execution Controls.” 

Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 
Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) Core 
See Appendix A.3, “VM-Execution Controls.” 


Register Address: 483H, 1155 IA32_VMX_EXIT_CTLS 


Capability Reporting Register of VM-Exit Controls (R/O) Core 
See Table 2-2. 

See Appendix A.4, “VM-Exit Controls.” 

Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 

Capability Reporting Register of VM-Entry Controls (R/O) Core 
See Table 2-2. 

See Appendix A.5, “VM-Entry Controls.” 

Register Address: 485H, 1157 IA32_VMX_MISC 

Reporting Register of Miscellaneous VMX Capabilities (R/O) Core 
See Table 2-2. 


See Appendix A.6, “Miscellaneous Data.” 


Register Address: 486H, 1158 IA32_VMX_CRO_FIXEDO 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Capability Reporting Register of CRO Bits Fixed to O (R/O) Core 
See Table 2-2. 

See Appendix A.7, “VMX-Fixed Bits in CRO.” 

Register Address: 487H, 1159 IA32_VMX_CRO_FIXED1 

Capability Reporting Register of CRO Bits Fixed to 1 (R/O) Core 
See Table 2-2. 

See Appendix A.7, “VMX-Fixed Bits in CRO.” 

Register Address: 488H, 1160 IA32_VMX_CR4_FIXEDO 

Capability Reporting Register of CR4 Bits Fixed to 0 (R/O) Core 
See Table 2-2. 

See Appendix A.8, “VMX-Fixed Bits in CR4.” 

Register Address: 489H, 1161 IA32_VMX_CR4_FIXED1 

Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) Core 
See Table 2-2. 

See Appendix A.8, “VMX-Fixed Bits in CR4.” 

Register Address: 48AH, 1162 IA32_VMX_VMCS_ENUM 

Capability Reporting Register of VMCS Field Enumeration (R/O) Core 
See Table 2-2. 

See Appendix A.9, “VMCS Enumeration.” 

Register Address: 48BH, 1163 IA32_VMX_PROCBASED_CTLS2 

Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) Core 
See Appendix A.3, "VM-Execution Controls.” 

Register Address: 48CH, 1164 IA32_VMX_EPT_VPID_ENUM 

Capability Reporting Register of EPT and VPID (R/O) Core 
See Table 2-2. 

Register Address: 48DH, 1165 IA32_VMX_TRUE_PINBASED_CTLS 

Capability Reporting Register of Pin-Based VM-Execution Flex Controls (R/O) Core 
See Table 2-2. 

Register Address: 48EH, 1166 IA32_VMX_TRUE_PROCBASED_CTLS 

Capability Reporting Register of Primary Processor-based VM-Execution Flex Controls (R/O) Core 
See Table 2-2. 

Register Address: 48FH, 1167 IA32_VMX_TRUE_EXIT_CTLS 

Capability Reporting Register of VM-Exit Flex Controls (R/O) Core 
See Table 2-2. 

Register Address: 490H, 1168 IA32_VMX_TRUE_ENTRY_CTLS 

Capability Reporting Register of VM-Entry Flex Controls (R/O) Core 
See Table 2-2. 

Register Address: 491H, 1169 IA32_VMX_FMFUNC 

Capability Reporting Register of VM-Function Controls (R/O) Core 
See Table 2-2. 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See Table 2-2. 


Register Address: COO0_0103H 


IA32_TSC_AUX 


Register Information / Bit Fields Bit Description Scope 

Register Address: 4C1H, 1217 IA32_A_PMCO 
See Table 2-2. Core 
Register Address: 4C2H, 1218 IA32_A_PMC1 
See Table 2-2. Core 
Register Address: 600H, 1536 IA32_DS_AREA 
DS Save Area (R/W) Core 
See Table 2-2 and Section 20.6.3.4, “Debug Store (DS) Mechanism." 
Register Address: 660H, 1632 MSR_CORE_C1_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 
63:0 CORE C1 Residency Counter. (R/O) 

Value since last reset that this core is in processor-specific C1 states. 

Counts at the TSC frequency. 
Register Address: 6EOH, 1760 IA32_TSC_DEADLINE 
TSC Target of Local APIC’s TSC Deadline Mode (R/W) Core 
See Table 2-2. 
Register Address: COOO_O0O80H IA32_EFER 
Extended Feature Enables Core 
See Table 2-2. 
Register Address: COOO_0081H IA32_STAR 
System Call Target Address (R/W) Core 
See Table 2-2. 
Register Address: COOO_0082H IA32_LSTAR 
IA-32e Mode System Call Target Address (R/W) Core 
See Table 2-2. 
Register Address: COOO_0084H IA32_FMASK 
System Call Flag Mask (R/W) Core 
See Table 2-2. 
Register Address: CO00_0100H IA32_FS_BASE 
Map of BASE Address of FS (R/W) Core 
See Table 2-2. 
Register Address: CO00_0101H IA32_GS_BASE 
Map of BASE Address of GS (R/W) Core 
See Table 2-2. 
Register Address: CO00_0102H IA32_KERNEL_GS_BASE 
Swap Target of BASE Address of GS (R/W) Core 
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Table 2-6. MSRs Common to Intel Atom® Processors (Silvermont and Newer Microarchitectures) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
AUXILIARY TSC Signature (R/W) Core 
See Table 2-2. 


Table 2-7 lists model-specific registers (MSRs) that are common to Intel Atom® processors based on the Silver- 
mont and Airmont microarchitectures but not newer microarchitectures. 


Table 2-7. MSRs Common to the Silvermont and Airmont Microarchitectures 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 17H, 23 MSR_PLATFORM_ID 
Model Specific Platform ID (R) Module 
7:0 Reserved. 
13:8 Maximum Qualified Ratio (R) 

The maximum allowed bus ratio. 

49:13 Reserved. 
52:50 See Table 2-2. 
63:33 Reserved. 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64Processor (R/W) Core 
See Table 2-2. 
0 Lock (R/WL) 
1 Reserved. 
2 Enable VMX outside SMX operation (R/WL) 
Register Address: 40H, 64 MSR_LASTBRANCH_O_FROM_IP 
Last Branch Record O From IP (R/W) Core 


One of eight pairs of last branch record registers on the last branch record stack. The From_IP part of the stack 
contains pointers to the source instruction. See also: 


* Last Branch Record Stack TOS at 1C9H. 
* Section 18.5 and record format in Section 18.4.8.1. 


Register Address: 41H, 65 MSR_LASTBRANCH_1_FROM_IP 


Last Branch Record 1 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 42H, 66 MSR_LASTBRANCH_2_FROM_IP 

Last Branch Record 2 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 43H, 67 MSR_LASTBRANCH_3_FROM_IP 

Last Branch Record 3 From IP (R/W) Core 


See description of MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 44H, 68 MSR_LASTBRANCH_4_FROM_IP 


Last Branch Record 4 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 
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Table 2-7. MSRs Common to the Silvermont and Airmont Microarchitectures (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 45H, 69 MSR_LASTBRANCH_5_FROM_IP 
Last Branch Record 5 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 46H, 70 MSR_LASTBRANCH_6_FROM_IP 
Last Branch Record 6 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 47H, 71 MSR_LASTBRANCH_7_FROM_IP 
Last Branch Record 7 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 60H, 96 MSR_LASTBRANCH_O_TO_IP 
Last Branch Record 0 To IP (R/W) Core 
One of eight pairs of last branch record registers on the last branch record stack. The To_IP part of the stack contains 
pointers to the destination instruction. 
Register Address: 61H, 97 MSR_LASTBRANCH_1_TO_IP 
Last Branch Record 1 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 62H, 98 MSR_LASTBRANCH_2_TO_IP 
Last Branch Record 2 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 63H, 99 MSR_LASTBRANCH_3_TO_IP 
Last Branch Record 3 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 64H, 100 MSR_LASTBRANCH_4_TO_IP 
Last Branch Record 4 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 65H, 101 MSR_LASTBRANCH_5_TO_IP 
Last Branch Record 5 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 66H, 102 MSR_LASTBRANCH_6_TO_IP 
Last Branch Record 6 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 67H, 103 MSR_LASTBRANCH_7_TO_IP 
Last Branch Record 7 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information: Contains power management and other model specific features enumeration. See Package 
http://biosbits.org. 
7:0 Reserved. 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the maximum frequency that does not require turbo. 
Frequency = ratio * Scalable Bus Frequency. 
63:16 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Module 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 
See http://biosbits.org. 
2:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
O0Ob: CO (no package C-sate support) 
001b: C1 (Behavior is the same as O00b) 
100b: C4 
110b: C6 
111b: C7 (Silvermont only) 
9:3 Reserved. 
10 1/0 MWAIT Redirection Enable (R/W) 
When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 
14:11 Reserved. 
15 CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 
63:16 Reserved. 
Register Address: 11€H, 281 MSR_BBL_CR_CTL3 
Control Register 3 Module 


Used to configure the L2 Cache. 
0 


L2 Hardware Enabled (R/O) 
1 = If the L2 is hardware-enabled. 
O= Indicates if the L2 is hardware-disabled. 


Reserved. 


L2 Enabled (R/W) 
1=  L2 cache has been initialized. 
O= Disabled (default). 


Until this bit is set the processor will not respond to the WBINVD instruction 
or the assertion of the FLUSH# input. 


22:9 


Reserved. 
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Table 2-7. MSRs Common to the Silvermont and Airmont Microarchitectures (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

23 L2 Not Present (R/O) 
O= L2 Present. 
1=  L2 Not Present. 

63:24 Reserved. 

Register Address: 1AQH, 416 IA32_MISC_ENABLE 

Enable Misc. Processor Features (R/W) 

Allows a variety of processor functions to be enabled and disabled. 

0 Fast-Strings Enable Core 
See Table 2-2. 

2:1 Reserved. 
Automatic Thermal Control Circuit Enable (R/W) Module 
See Table 2-2. Default value is 0. 

6:4 Reserved. 
Performance Monitoring Available (R) Core 
See Table 2-2. 

10:8 Reserved. 

11 Branch Trace Storage Unavailable (R/O) Core 
See Table 2-2. 

12 Processor Event Based Sampling Unavailable (R/O) Core 
See Table 2-2. 

15:13 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) Module 
See Table 2-2. 

18 ENABLE MONITOR FSM (R/W) Core 
See Table 2-2. 

21:19 Reserved. 

22 Limit CPUID Maxval (R/W) Core 
See Table 2-2. 

23 XTPR Message Disable (R/W) Module 
See Table 2-2. 

33:24 Reserved. 

34 XD Bit Disable (R/W) Core 
See Table 2-3. 

37:35 Reserved. 
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Table 2-7. MSRs Common to the Silvermont and Airmont Microarchitectures (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


38 Turbo Mode Disable (R/W) Module 


When set to 1 on processors that support Intel Turbo Boost Technology, the 
turbo mode feature is disabled and the IDA_Enable feature flag will be 
cleared (CPUID.O6H: EAX[1]=0). 

When set to a O on processors that support IDA, CPUID.O6H: EAX[1] reports 
the processor's support of turbo mode is enabled. 


Note: The power-on default value is used by BIOS to detect hardware 
support of turbo mode. If the power-on default value is 1, turbo mode is 
available in the processor. If the power-on default value is 0, turbo mode is 


not available. 
63:39 Reserved. 
Register Address: 1C8H, 456 MSR_LBR_SELECT 
Last Branch Record Filtering Select Register (R/W) Core 
See Section 18.9.2, “Filtering of Last Branch Records.” 
0 CPL_EQ_O 
1 CPL_NEQ_O 
2 jcc 
3 NEAR_REL_CALL 
4 NEAR_IND_CALL 
5 NEAR_RET 
6 NEAR_IND_JMP 
7 NEAR_REL_JMP 
8 FAR_BRANCH 
63:9 Reserved. 
Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/W) Core 


Contains an index (bits 0-2) that points to the MSR containing the most recent branch record. 
See MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 

See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Core 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 

See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Core 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 

See Table 2-2. See Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Core 
0 Enable PEBS for precise event on [A32_PMCO (R/W) 

Register Address: 3FAH, 1018 MSR_PKG_C6_RESIDENCY 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 


63:0 Package C6 Residency Counter (R/O) 


Value since last reset that this package is in processor-specific C6 states. 
Counts at the TSC Frequency. 
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Table 2-7. MSRs Common to the Silvermont and Airmont Microarchitectures (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


ACPI C-States. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 


Register Information / Bit Fields Bit Description Scope 
Register Address: 664H, 1636 MSR_MC6_RESIDENCY_COUNTER 
Module C6 Residency Counter (R/O) Module 


63:0 Time that this module is in module-specific C6 states since last reset. Counts 
at 1 Mhz frequency. 
2.4.1 MSRs with Model-Specific Behavior in the Silvermont Microarchitecture 


Table 2-8 lists MSRs that are specific to the Intel Atom® processor E3000 Series (CPUID Signature 
DisplayFamily_DisplayModel value of 06_37H) and Intel Atom processors (CPUID Signature 
DisplayFamily_DisplayModel value of 06_4AH, 06_5AH, or 06_5DH). 


Table 2-8. Specific MSRs Supported by Intel Atom® Processors with a CPUID Signature DisplayFamily_DisplayModel 


Value of 06_37H, 06_4AH, 06_5AH, or 06_5DH 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Module 
This field indicates the intended scalable bus clock speed for processors based on Silvermont microarchitecture. 
2:0 = 100B: 080.0 MHz 
* OQOOB: 083.3 MHz 
* 001B: 100.0 MHz 
= 010B: 133.3 MHz 
= 011B: 116.7 MHz 
63:3 Reserved. 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers used in RAPL Interfaces (R/O) Package 
See Section 15.10.1, “RAPL Interfaces.” 
3:0 Power Units 
Power related information (in milliwatts) is based on the multiplier, 2*PU; 
where PU is an unsigned integer represented by bits 3:0. Default value is 
01016, indicating power unit is in 32 milliwatts increment. 
7:4 Reserved. 
12:8 Energy Status Units 
Energy related information (in microjoules) is based on the multiplier, 2*ESU; 
where ESU is an unsigned integer represented by bits 12:8. Default value is 
00101b, indicating energy unit is in 32 microJoules increment. 
15:13 Reserved. 
19:16 Time Unit 
The value is OO00b, indicating time unit is in one second. 
63:20 Reserved. 
Register Address: 610H, 1552 MSR_PKG_POWER_LIMIT 
PKG RAPL Power Limit Control (R/W) Package 
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Table 2-8. Specific MSRs Supported by Intel Atom® Processors with a CPUID Signature DisplayFamily_DisplayModel 


Value 


of 06_37H, 06_4AH, 06_5AH, or 06_5DH (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See Section 15.10.4, “PPO/PP1 RAPL Domains,” and MSR_RAPL_POWER_UNIT in Table 2-8. 


Register Information / Bit Fields Bit Description Scope 
14:0 Package Power Limit #1 (R/W) 
See Section 15.10.3, “Package RAPL Domain,” and MSR_RAPL_POWER_UNIT 
in Table 2-8. 
15 Enable Power Limit #1 (R/W) 
See Section 15.10.3, “Package RAPL Domain.” 
16 Package Clamping Limitation #1 (R/W) 
See Section 15.10.3, “Package RAPL Domain.” 
23:17 Time Window for Power Limit #1 (R/W) 
In unit of second. If 0 is specified in bits [23:17], defaults to 1 second 
window. 
63:24 Reserved. 
Register Address: 611H, 1553 MSR_PKG_ENERGY_STATUS 
PKG Energy Status (R/O) Package 
See Section 15.10.3, “Package RAPL Domain,” and MSR_RAPL_POWER_UNIT in Table 2-8. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 


Table 2-9 lists model-specific registers (MSRs) that are specific to the Intel Atom® processor E3000 Series (CPUID 


Signature DisplayFamily_DisplayM 


odel value of 06_37H). 


Table 2-9. Specific MSRs Supported by the Intel Atom® Processor E3000 Series with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_37H 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


ACPI C-States. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 


Register Information / Bit Fields Bit Description Scope 
Register Address: 668H, 1640 MSR_CC6_DEMOTION_POLICY_CONFIG 
Core C6 Demotion Policy Config MSR Package 
63:0 Controls per-core C6 demotion policy. Writing a value of O disables core 
level HW demotion policy. 
Register Address: 669H, 1641 MSR_MC6_DEMOTION_POLICY_CONFIG 
Module C6 Demotion Policy Config MSR Package 
63:0 Controls module (i.e., two cores sharing the second-level cache) C6 
demotion policy. Writing a value of O disables module level HW demotion 
policy. 
Register Address: 664H, 1636 MSR_MC6_RESIDENCY_COUNTER 
Module C6 Residency Counter (R/O) Module 


63:0 


Time that this module is in module-specific C6 states since last reset. 
Counts at 1 Mhz frequency. 
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Table 2-10 lists model-specific registers (MSRs) that are specific to Intel Atom® processor C2000 Series (CPUID 
Signature DisplayFamily_DisplayModel value of 06_4DH). 


Table 2-10. Specific MSRs Supported by Intel Atom® Processor C2000 Series with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_4DH 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 1A4H, 420 MSR_MISC_FEATURE_CONTROL 

Miscellaneous Feature Control (R/W) 

0 L2 Hardware Prefetcher Disable (R/w) Core 
If 1, disables the L2 hardware prefetcher, which fetches additional lines of 
code or data into the L2 cache. 

1 Reserved. 

2 DCU Hardware Prefetcher Disable (R/w) Core 
If 1, disables the L1 data cache prefetcher, which fetches the next cache 
line into L1 data cache. 

63:3 Reserved. 

Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 

Maximum Ratio Limit of Turbo Mode (R/W) Package 

7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 

39:32 Maximum Ratio Limit for 5C Package 
Maximum turbo ratio limit of 5 core active. 

47:40 Maximum Ratio Limit for 6C Package 
Maximum turbo ratio limit of 6 core active. 

55:48 Maximum Ratio Limit for 7C Package 
Maximum turbo ratio limit of 7 core active. 

63:56 Maximum Ratio Limit for 8C Package 
Maximum turbo ratio limit of 8 core active. 

Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 

Unit Multipliers used in RAPL Interfaces (R/O) Package 

See Section 15.10.1, “RAPL Interfaces.” 

3:0 Power Units 
Power related information (in milliwatts) is based on the multiplier, 2*PU; 
where PU is an unsigned integer represented by bits 3:0. Default value is 
01016, indicating power unit is in 32 milliwatts increment. 

7:4 Reserved. 
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Table 2-10. Specific MSRs Supported by Intel Atom’ Processor C2000 Series with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_4DH (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
12:8 Energy Status Units. 
Energy related information (in microjoules) is based on the multiplier, 
2”~ESU; where ESU is an unsigned integer represented by bits 12:8. 
Default value is 00101b, indicating energy unit is in 32 microjoules 
increment. 
15:13 Reserved. 
19:16 Time Unit 
The value is OOO0Ob, indicating time unit is in one second. 
63:20 Reserved. 
Register Address: 610H, 1552 MSR_PKG_POWER_LIMIT 
PKG RAPL Power Limit Control (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 66EH, 1646 MSR_PKG_POWER_INFO 
PKG RAPL Parameter (R/O) Package 


14:0 Thermal Spec Power (R/O) 
The unsigned integer value is the equivalent of the thermal specification 
power of the package domain. The unit of this field is specified by the 
“Power Units” field of MSR_RAPL_POWER_UNIT. 
63:15 Reserved. 
2.4.2 MSRs in Intel Atom® Processors Based on Airmont Microarchitecture 


Intel Atom processor X7-Z8000 and X5-Z8000 series are based on the Airmont microarchitecture. These proces- 
sors support MSRs listed in Table 2-6, Table 2-7, Table 2-8, and Table 2-11. These processors have a CPUID 
Signature DisplayFamily_DisplayModel value of 06_4CH; see Table 2-1. 


Table 2-11. MSRs in Intel Atom® Processors Based on Airmont Microarchitecture 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Module 


This field indicates the intended scalable bus clock speed for processors based on Airmont microarchitecture. 


3:0 


OOOOB: 083.3 MHz 
0001B: 100.0 MHz 
0010B: 133.3 MHz 
0011B: 116.7 MHz 
0100B: 080.0 MHz 
0101B: 093.3 MHz 
0110B: 090.0 MHz 
0111B: 088.9 MHz 
1000B: 087.5 MHz 


63:5 


Reserved. 


Register Address: E2H, 226 


MSR_PKG_CST_CONFIG_CONTROL 
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Table 2-11. MSRs in Intel Atom® Processors Based on Airmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
C-State Configuration Control (R/W) Module 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 

See http://biosbits.org. 

2:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
OOO: No limit 
001b: C1 
010b: C2 
110b: C6 
111b: C7 

9:3 Reserved. 

10 I/O MWAIT Redirection Enable (R/W) 
When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 

14:11 Reserved. 

15 CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 

63:16 Reserved. 

Register Address: E4H, 228 MSR_PMG_IO_CAPTURE_BASE 

Power Management IO Redirection in C-state (R/W) Module 

See http://biosbits.org. 

15:0 LVL_2 Base Address (R/W) 
Specifies the base address visible to software for IO redirection. If 10 
MWAIT Redirection is enabled, reads to this address will be consumed by 
the power management logic and decoded to MWAIT instructions. When IO 
port address redirection is enabled, this is the |O port address reported to 
the OS/software. 

18:16 C-state Range (R/W) 
Specifies the encoding value of the maximum C-State code name to be 
included when IO read to MWAIT redirection is enabled by 
MSR_PKG_CST_CONFIG_CONTROL[bit1 0}: 
000b - C3 is the max C-State to include. 
001b - Deep Power Down Technology is the max C-State. 
010b - C7 is the max C-State to include. 

63:19 Reserved. 

Register Address: 638H, 1592 MSR_PPO_POWER_LIMIT 

|PPORAPLPowerLimitControl(RW) eT ackage | 
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Table 2-11. MSRs in Intel Atom® Processors Based on Airmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


14:0 


PPO Power Limit #1 (R/W) 


See Section 15.10.4, “PPO/PP1 RAPL Domains,” and 
MSR_RAPL_POWER_UNIT in Table 2-8. 


Enable Power Limit #1 (R/W) 
See Section 15.10.4, “PPO/PP1 RAPL Domains." 


Reserved. 


23:17 


Time Window for Power Limit #1 (R/W) 


Specifies the time duration over which the average power must remain 
below PPO_POWER_LIMIT #1(14:0). Supported Encodings: 


0x0: 1 second time duration. 
0x1: 5 second time duration (Default). 
Ox2: 10 second time duration. 
0x3: 15 second time duration. 
0x4: 20 second time duration. 
Ox5: 25 second time duration. 
Ox6: 30 second time duration. 
0x7: 35 second time duration. 
Ox8: 40 second time duration. 
0x9: 45 second time duration. 
OxA: 50 second time duration. 
OxB-0x7F - reserved. 


63:24 


Reserved. 


2.5 MSRS IN INTEL ATOM® PROCESSORS BASED ON GOLDMONT 
MICROARCHITECTURE 


Intel Atom processors based on the Goldmont microarchitecture support MSRs listed in Table 2-6 and Table 2-12. 
These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_5CH; see Table 2-1. 


In the Goldmont microarchitecture, the scope column indicates the following: “Core” means each processor core 

has a separate MSR, or a bit field not shared with another processor core. “Module” means the MSR or the bit field 
is shared by a subset of the processor cores in the physical package. The number of processor cores in this subset 
is model specific and may differ between different processors. For all processors based on Goldmont microarchitec- 
ture, the L2 cache is also shared between cores in a module and thus CPUID leaf 04H enumeration can be used to 
figure out which processors are in the same module. “Package” means all processor cores in the physical package 


share the same MSR or bit interface. 


Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 17H, 23 MSR_PLATFORM_ID 
Model Specific Platform ID (R) Module 
49:0 Reserved. 
52:50 See Table 2-2. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
63:33 Reserved. 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64 Processor (R/W) Core 
See Table 2-2. 
0 Lock (R/WL) 
1 Enable VMX inside SMX operation (R/WL) 
2 Enable VMX outside SMX operation (R/WL) 
14:8 SENTER local functions enables (R/WL) 
15 SENTER global functions enable (R/WL) 
18 SGX global functions enable (R/WL) 
63:19 Reserved. 
Register Address: 3BH, 59 IA32_TSC_ADJUST 
Per-Core TSC ADJUST (R/W) Core 
See Table 2-2. 
Register Address: C3H, 195 IA32_PMC2 
Performance Counter Register Core 
See Table 2-2. 
Register Address: C4H, 196 IA32_PMC3 
Performance Counter Register Core 
See Table 2-2. 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the maximum frequency that does not require turbo. 
Frequency = ratio * 100 MHz. 
27:16 Reserved. 
28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to 0, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 
29 Programmable TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDP Limit for Turbo mode is programmable. 
When set to 0, indicates TDP Limit for Turbo mode is not programmable. 
30 Programmable T] OFFSET (R/O) Package 
When set to 1, indicates that MSR_TEMPERATURE_TARGET.[27:24] is 
valid and writable to specify a temperature offset. 
39:31 Reserved. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 1OOMHz. 
63:48 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 
See http://biosbits.org. 
3:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
OOOOb: No limit 
0001b: C1 
0010b: C3 
0011b: C6 
0100b: C7 
0101b: C7S 
0110b: C8 
0111b: C9 
1000b: C10 
9:3 Reserved. 
10 1/0 MWAIT Redirection Enable (R/W) 
When set, will map |O_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 
14:11 Reserved. 
15 CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 
63:16 Reserved. 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Core 
Reports SMM capability enhancement. Accessible only while in SMM. 
57:0 Reserved. 
58 SMM_Code_Access_Chk (SMM-RO) 
If set to 1 indicates that the SMM code access restriction is supported and 
the MSR_SMM_FEATURE_CONTROL is supported. 
59 Long_Flow_Indication (SMM-RO) 
If set to 1 indicates that the SMM long flow indicator is supported and the 
MSR_SMM_DELAYED is supported. 
63:60 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

Register Address: 188H, 392 IA32_PERFEVTSEL2 

See Table 2-2. Core 

Register Address: 189H, 393 IA32_PERFEVTSEL3 

See Table 2-2. Core 

Register Address: 1AQH, 416 IA32_MISC_ENABLE 

Enable Misc. Processor Features (R/W) 

Allows a variety of processor functions to be enabled and disabled. 

0 Fast-Strings Enable Core 
See Table 2-2. 

2:1 Reserved. 
Automatic Thermal Control Circuit Enable (R/W) Package 
See Table 2-2. Default value is 1. 

6:4 Reserved. 
Performance Monitoring Available (R) Core 
See Table 2-2. 

10:8 Reserved. 

11 Branch Trace Storage Unavailable (R/O) Core 
See Table 2-2. 

12 Processor Event Based Sampling Unavailable (R/O) Core 
See Table 2-2. 

15:13 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) Package 
See Table 2-2. 

18 ENABLE MONITOR FSM (R/W) Core 
See Table 2-2. 

21:19 Reserved. 

22 Limit CPUID Maxval (R/W) Core 
See Table 2-2. 

23 xTPR Message Disable (R/W) Package 
See Table 2-2. 

33:24 Reserved. 

34 XD Bit Disable (R/W) Core 
See Table 2-3. 

37:35 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
38 Turbo Mode Disable (R/W) Package 
When set to 1 on processors that support Intel Turbo Boost Technology, 
the turbo mode feature is disabled and the IDA_Enable feature flag will be 
clear (CPUID.OGH: EAX[1]=0). 
When set to a O on processors that support IDA, CPUID.OGH: EAX[1] 
reports the processor's support of turbo mode is enabled. 
Note: The power-on default value is used by BIOS to detect hardware 
support of turbo mode. If the power-on default value is 1, turbo mode is 
available in the processor. If the power-on default value is 0, turbo mode 
is not available. 
63:39 Reserved. 
Register Address: 1A4H, 420 MSR_MISC_FEATURE_CONTROL 
Miscellaneous Feature Control (R/W) 
0 L2 Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L2 hardware prefetcher, which fetches additional lines of 
code or data into the L2 cache. 
1 Reserved. 
2 DCU Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L1 data cache prefetcher, which fetches the next cache 
line into L1 data cache. 
63:3 Reserved. 
Register Address: 1AAH, 426 MSR_MISC_PWR_MGMT 
Miscellaneous Power Management Control Package 
Various model specific features enumeration. See http://biosbits.org. 
0 EIST Hardware Coordination Disable (R/W) 
When 0, enables hardware coordination of Enhanced Intel Speedstep 
Technology request from processor cores. When 1, disables hardware 
coordination of Enhanced Intel Speedstep Technology requests. 
21:1 Reserved. 
22 Thermal Interrupt Coordination Enable (R/W) 
If set, then thermal interrupt on one core is routed to all cores. 
63:23 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_ LIMIT 
Maximum Ratio Limit of Turbo Mode by Core Groups (R/W) Package 
Specifies Maximum Ratio Limit for each Core Group. Max ratio for groups with more cores must decrease 
monotonically. 
For groups with less than 4 cores, the max ratio must be 32 or less. For groups with 4-5 cores, the max ratio must be 
22 or less. For groups with more than 5 cores, the max ratio must be 16 or less. 
7:0 Maximum Ratio Limit for Active Cores in Group O Package 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group O threshold. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


15:8 


Maximum Ratio Limit for Active Cores in Group 1 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 1 threshold, and greater than the Group O threshold. 


Package 


23:16 


Maximum Ratio Limit for Active Cores in Group 2 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 2 threshold, and greater than the Group 1 threshold. 


Package 


31:24 


Maximum Ratio Limit for Active Cores in Group 3 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 3 threshold, and greater than the Group 2 threshold. 


Package 


39:32 


Maximum Ratio Limit for Active Cores in Group 4 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 4 threshold, and greater than the Group 3 threshold. 


Package 


47:40 


Maximum Ratio Limit for Active Cores in Group 5 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 5 threshold, and greater than the Group 4 threshold. 


Package 


55:48 


Maximum Ratio Limit for Active Cores in Group 6 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 6 threshold, and greater than the Group 5 threshold. 


Package 


63:56 


Maximum Ratio Limit for Active Cores in Group 7 


Maximum turbo ratio limit when the number of active cores is less than or 
equal to the Group 7 threshold, and greater than the Group 6 threshold. 


Package 


Register Address: 1AEH, 430 


MSR_TURBO_GROUP_CORECNT 


Group Size of Active Cores for Turbo Mode Operation (R/W) 


Writes of O threshold is ignored. 
7:0 


Group O Core Count Threshold 


Maximum number of active cores to operate under the Group 0 Max Turbo 
Ratio limit. 


Package 


Package 


Group 1 Core Count Threshold 


Maximum number of active cores to operate under the Group 1 Max Turbo 
Ratio limit. Must be greater than the Group O Core Count. 


Package 


23:16 


Group 2 Core Count Threshold 


Maximum number of active cores to operate under the Group 2 Max Turbo 
Ratio limit. Must be greater than the Group 1 Core Count. 


Package 


31:24 


Group 3 Core Count Threshold 


Maximum number of active cores to operate under the Group 3 Max Turbo 
Ratio limit. Must be greater than the Group 2 Core Count. 


Package 


39:32 


Group 4 Core Count Threshold 


Maximum number of active cores to operate under the Group 4 Max Turbo 
Ratio limit. Must be greater than the Group 3 Core Count. 


Package 


47:40 


Group 5 Core Count Threshold 


Maximum number of active cores to operate under the Group 5 Max Turbo 
Ratio limit. Must be greater than the Group 4 Core Count. 


Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

55:48 Group 6 Core Count Threshold Package 
Maximum number of active cores to operate under the Group 6 Max Turbo 
Ratio limit. Must be greater than the Group 5 Core Count. 

63:56 Group 7 Core Count Threshold Package 
Maximum number of active cores to operate under the Group 7 Max Turbo 
Ratio limit. Must be greater than the Group 6 Core Count, and not less than 
the total number of processor cores in the package. E.g., specify 255. 

Register Address: 1C8H, 456 MSR_LBR_SELECT 

Last Branch Record Filtering Select Register (R/W) Core 

See Section 18.9.2, “Filtering of Last Branch Records.” 

0 CPL_EQ_O 

1 CPL_NEQ_O 

2 JCC 

3 NEAR_REL_CALL 

4 NEAR_IND_CALL 

5 NEAR_RET 

6 NEAR_IND_JMP 

7 NEAR_REL_JMP 

8 FAR_BRANCH 

9 EN_CALL_STACK 

63:10 Reserved. 

Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 

Last Branch Record Stack TOS (R/W) Core 


Contains an index (bits 0-4) that points to the MSR containing the most recent branch record. 
See MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 1FCH, 508 MSR_POWER_CTL 


Power Control Register Core 
See http://biosbits.org. 
0 Reserved. 
1 C1E Enable (R/W) Package 
When set to ‘1’, will enable the CPU to switch to the Minimum Enhanced 
Intel SpeedStep Technology operating point when all execution cores 
enter MWAIT (C1). 
63:2 Reserved. 
Register Address: 210H, 528 IA32_MTRR_PHYSBASE8 
See Table 2-2. Core 
Register Address: 211H, 529 IA32_MTRR_PHYSMASK8 
See Table 2-2. Core 
Register Address: 212H, 530 IA32_MTRR_PHYSBASE9 
See Table 2-2. Core 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: IA32_MTRR_PHYSMASK9 
213H, 531 See Table 2-2. Core 
Register Address: IA32_MCO_CTL2 
280H, 640 See Table 2-2. Module 
Register Address: IA32_MC1_CTL2 
281H, 641 See Table 2-2. Module 
Register Address: IA32_MC2_CTL2 
282H, 642 See Table 2-2. Core 
Register Address: 283H, 643 IA32_MC3_CTL2 
See Table 2-2. Module 
Register Address: 284H, 644 IA32_MC4_CTL2 
See Table 2-2. Package 
Register Address: 285H, 645 IA32_MC5_CTL2 
See Table 2-2. Package 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 300H, 768 MSR_SGXOWNEREPOCHO 
Lower 64 Bit CR_SGXOWNEREPOCH (Ww) Package 
Writes do not update CR_SGXOWNEREPOCH if CPUID.(EAX=1 2H, ECX=0):EAX.SGX1 is 1 on any thread in the package. 
63:0 Lower 64 bits of an 128-bit external entropy value for key derivation of 
an enclave. 
Register Address: 301H, 769 MSR_SGXOWNEREPOCH1 
Upper 64 Bit CR_SGXOWNEREPOCH (Ww) Package 
Writes do not update CR_SGXOWNEREPOCH if CPUID.(EAX=1 2H, ECX=0):EAX.SGX1 is 1 on any thread in the package. 
63:0 Upper 64 bits of an 128-bit external entropy value for key derivation of 
an enclave. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” Core 
0 Ovf_PMCO 
1 Ovf_PMC1 
2 Ovf_PMC2 
3 Ovf_PMC3 
31:4 Reserved. 
32 Ovf_FixedCtrO 
33 Ovf_FixedCtr1 
34 Ovf_FixedCtr2 
54:35 Reserved. 
55 Trace_ToPA_PMI 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

57:56 Reserved. 

58 LBR_Frz 

59 CTR_Frz 

60 ASCI 

61 Ovf_Uncore 

62 Ovf_BufDSSAVE 

63 CondChgd 

Register Address: 390H, 912 IA32_PERF_GLOBAL_STATUS_RESET 

See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” Core 

0 Set 1 to clear Ovf_PMCO. 

1 Set 1 to clear Ovf_PMC1. 

2 Set 1 to clear Ovf_PMC2. 

3 Set 1 to clear Ovf_PMC3. 

31:4 Reserved. 

32 Set 1 to clear Ovf_FixedCtr0. 

33 Set 1 to clear Ovf_FixedCtr1. 

34 Set 1 to clear Ovf_FixedCtr2. 

54:35 Reserved. 

55 Set 1 to clear Trace_ToPA_PMI. 

57:56 Reserved. 

58 Set 1 to clear LBR_Frz. 

59 Set 1 to clear CTR_Frz. 

60 Set 1 to clear ASCI. 

61 Set 1 to clear Ovf_Uncore. 

62 Set 1 to clear Ovf_BufDSSAVE. 

63 Set 1 to clear CondChad. 

Register Address: 391H, 913 IA32_PERF_GLOBAL_STATUS_SET 

See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” Core 

0 Set 1 to cause Ovf_PMCO = 1. 

1 Set 1 to cause Ovf_PMC1 = 1. 

2 Set 1 to cause Ovf_PMC2 = 1. 

3 Set 1 to cause Ovf_PMC3 = 1. 

31:4 Reserved. 

32 Set 1 to cause Ovf_FixedCtrO = 1. 

33 Set 1 to cause Ovf_FixedCtr1 = 1. 

34 Set 1 to cause Ovf_FixedCtr2 = 1. 

54:35 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
55 Set 1 to cause Trace_ToPA_PMI = 1. 
57:56 Reserved. 
58 Set 1 to cause LBR_Frz = 1. 
59 Set 1 to cause CTR_Frz = 1. 
60 Set 1 to cause ASCI = 1. 
61 Set 1 to cause Ovf_Uncore. 
62 Set 1 to cause Ovf_BufDSSAVE. 
63 Reserved. 
Register Address: 392H, 914 IA32_PERF_GLOBAL_INUSE 
See Table 2-2. Core 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
See Table 2-2 and Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Core 
0 Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMCO. (R/W) 
Register Address: 3F8H, 1016 MSR_PKG_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C3 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C3 states. 
Count at the same frequency as the TSC. 
Register Address: 3F9H, 1017 MSR_PKG_C6_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C6 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C6 states. 
Count at the same frequency as the TSC. 
Register Address: 3FCH, 1020 MSR_CORE_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 
63:0 CORE C3 Residency Counter (R/O) 
Value since last reset that this core is in processor-specific C3 states. 
Count at the same frequency as the TSC. 
Register Address: 406H, 1030 IA32_MC1_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Module 
The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC2_STATUS register is clear. 
When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 
Register Address: 418H, 1048 IA32_MC6_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 419H, 1049 IA32_MC6_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 41AH, 1050 IA32_MC6_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 4C3H, 1219 IA32_A_PMC2 
See Table 2-2. Core 
Register Address: 4C4H, 1220 IA32_A_PMC3 
See Table 2-2. Core 
Register Address: 4€0H, 1248 MSR_SMM_FEATURE_CONTROL 
Enhanced SMM Feature Control (SMM-RW) Package 
Reports SMM capability Enhancement. Accessible only while in SMM. 
0 Lock (SMM-RWO) 
When set to ‘1’ locks this register from further changes. 
1 Reserved. 
2 SMM_Code_Chk_En (SMM-RW) 
This control bit is available only if MSR_SMM_MCA_CAP[58] == 1. When 
set to ‘0’ (default) none of the logical processors are prevented from 
executing SMM code outside the ranges defined by the SMRR. 
When set to ‘1’ any logical processor in the package that attempts to 
execute SMM code not within the ranges defined by the SMRR will assert 
an unrecoverable MCE. 
63:3 Reserved. 
Register Address: 4€2H, 1250 MSR_SMM_DELAYED 
SMM Delayed (SMM-RO) Package 
Reports the interruptible state of all logical processors in the package. Available only while in SMM and 
MSR_SMM_MCA_CAP[LONG_FLOW_INDICATION] == 1. 
N-1:0 LOG_PROC_STATE (SMM-RO) 
Each bit represents a processor core of its state in a long flow of internal 
operation which delays servicing an interrupt. The corresponding bit will 
be set at the start of long events such as: Microcode Update Load, C6, 
WBINVD, Ratio Change, Throttle. 
The bit is automatically cleared at the end of each long event. The reset 
value of this field is 0. 
Only bit positions below N = CPUID.(EAX=OBH, ECX=PKG_LVL):EBX[1 5:0] 
can be updated. 
63:N Reserved. 
Register Address: 4€3H, 1251 MSR_SMM_BLOCKED 
SMM Blocked (SMM-RO) Package 
Reports the blocked state of all logical processors in the package. Available only while in SMM. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
N-1:0 LOG_PROC_STATE (SMM-RO) 
Each bit represents a processor core of its blocked state to service an SMI. 
The corresponding bit will be set if the logical processor is in one of the 
following states: Wait For SIPI or SENTER Sleep. 
The reset value of this field is OFFFH. 
Only bit positions below N = CPUID.(EAX=OBH, ECX=PKG_LVL):€BX[1 5:0] 
can be updated. 
63:N Reserved. 
Register Address: 500H, 1280 IA32_SGX_SVN_STATUS 
Status and SVN Threshold of SGX Support for ACM (R/O) Core 
0 Lock 
See Section 39.11.3, “Interactions with Authenticated Code Modules 
(ACMs).” 
15:1 Reserved. 
23:16 SGX_SVN_SINIT 
See Section 39.11.3, “Interactions with Authenticated Code Modules 
(ACMs).” 
63:24 Reserved. 
Register Address: 560H, 1376 IA32_RTIT_OUTPUT_BASE 
Trace Output Base Register (R/W) Core 
See Table 2-2. 
Register Address: 561H, 1377 IA32_RTIT_OUTPUT_MASK_PTRS 
Trace Output Mask Pointers Register (R/W) Core 
See Table 2-2. 
Register Address: 570H, 1392 IA32_RTIT_CTL 
Trace Control Register (R/W) Core 
0 TraceEn 
1 CYCEn 
2 Os 
3 User 
6:4 Reserved, must be zero. 
7 CR3Filter 
8 ToPA 
Writing O will #GP if also setting TraceEn. 
9 MTCEn 
10 TSCEn 
11 DisRETC 
12 Reserved, must be zero. 
13 BranchEn 
17:14 MTCFreq 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
18 Reserved, must be zero. 
22:19 CycThresh 
23 Reserved, must be zero. 
27:24 PSBFreq 
31:28 Reserved, must be zero. 
35:32 ADDRO_CFG 
39:36 ADDR1_CFG 
63:40 Reserved, must be zero. 
Register Address: 571H, 1393 IA32_RTIT_STATUS 
Tracing Status Register (R/W) Core 
0 FilterEn 
Writes ignored. 
1 ContexEn 
Writes ignored. 
2 TriggerEn 
Writes ignored. 
3 Reserved 
4 Error (R/W) 
5 Stopped 
31:6 Reserved, must be zero. 
48:32 PacketByteCnt 
63:49 Reserved, must be zero. 
Register Address: 572H, 1394 IA32_RTIT_CR3_MATCH 
Trace Filter CR3 Match Register (R/W) Core 
4:0 Reserved 
63:5 CR3[63:5] value to match. 
Register Address: 580H, 1408 IA32_RTIT_ADDRO_A 
Region O Start Address (R/W) Core 
63:0 See Table 2-2. 
Register Address: 581H, 1409 IA32_RTIT_ADDRO_B 
Region O End Address (R/W) Core 
63:0 See Table 2-2. 
Register Address: 582H, 1410 IA32_RTIT_ADDR1_A 
Region 1 Start Address (R/W) Core 
63:0 See Table 2-2. 
Register Address: 583H, 1411 IA32_RTIT_ADDR1_B 
Region 1 End Address (R/W) Core 
63:0 See Table 2-2. 
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This MSR defines the interrupt response time limit used by the processor to manage a transition to a package C6 or 
C7S state. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. 


9:0 Interrupt Response Time Limit (R/W) 


Specifies the limit that should be used to decide if the package should be 
put into a package C6 or C7S state. 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers used in RAPL Interfaces (R/O) Package 
See Section 15.10.1, “RAPL Interfaces.” 
3:0 Power Units 
Power related information (in Watts) is in unit of 1W/2*PU; where PU is an 
unsigned integer represented by bits 3:0. Default value is 1000b, 
indicating power unit is in 3.9 milliwatts increment. 
7:4 Reserved. 
12:8 Energy Status Units 
Energy related information (in Joules) is in unit of 1Joule/ (2*ESU); where 
ESU is an unsigned integer represented by bits 12:8. Default value is 
011105, indicating energy unit is in 61 microjoules. 
15:13 Reserved. 
19:16 Time Unit 
Time related information (in seconds) is in unit of 1S/2*TU; where TU is an 
unsigned integer represented by bits 19:16. Default value is 1010b, 
indicating power unit is in 0.977 millisecond. 
63:20 Reserved. 
Register Address: 60AH, 1546 MSR_PKGC3_IRTL 
Package C3 Interrupt Response Limit (R/W) Package 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 
9:0 Interrupt Response Time Limit (R/W) 
Specifies the limit that should be used to decide if the package should be 
put into a package C3 state. 
12:10 Time Unit (R/W) 
Specifies the encoding value of time unit of the interrupt response time 
limit. See Table 2-20 for supported time unit encodings. 
14:13 Reserved. 
15 Valid (R/w) 
Indicates whether the values in bits 12:0 are valid and can be used by the 
processor for package C-sate management. 
63:16 Reserved. 
Register Address: 60BH, 1547 MSR_PKGC_IRTL1 
Package C6/C7S Interrupt Response Limit 1 (R/W) Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
12:10 Time Unit (R/W) 
Specifies the encoding value of time unit of the interrupt response time 
limit. See Table 2-20 for supported time unit encodings. 
14:13 Reserved. 
15 Valid (R/W) 
Indicates whether the values in bits 12:0 are valid and can be used by the 
processor for package C-sate management. 
63:16 Reserved. 
Register Address: 60CH, 1548 MSR_PKGC_IRTL2 
Package C7 Interrupt Response Limit 2 (R/W) Package 
This MSR defines the interrupt response time limit used by the processor to manage a transition to a package C7 
State. 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 
9:0 Interrupt Response Time Limit (R/W) 
Specifies the limit that should be used to decide if the package should be 
put into a package C7 state. 
12:10 Time Unit (R/W) 
Specifies the encoding value of time unit of the interrupt response time 
limit. See Table 2-20 for supported time unit encodings. 
14:13 Reserved. 
15 Valid (R/W) 
Indicates whether the values in bits 12:0 are valid and can be used by the 
processor for package C-sate management. 
63:16 Reserved. 
Register Address: 60DH, 1549 MSR_PKG_C2_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-states. 
63:0 Package C2 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C2 states. 
Count at the same frequency as the TSC. 
Register Address: 610H, 1552 MSR_PKG_POWER_LIMIT 
PKG RAPL Power Limit Control (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 611H, 1553 MSR_PKG_ENERGY_STATUS 
PKG Energy Status (R/O) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 613H, 1555 MSR_PKG_PERF_STATUS 
PKG Perf Status (R/O) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 614H, 1556 MSR_PKG_POWER_INFO 
PKG RAPL Parameters (R/W) Package 
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See Section 15.10.4, “PPO/PP1 RAPL Domains." 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
14:0 Thermal Spec Power (R/W) 
See Section 15.10.3, “Package RAPL Domain.” 
15 Reserved. 
30:16 Minimum Power (R/W) 
See Section 15.10.3, “Package RAPL Domain.” 
31 Reserved. 
46:32 Maximum Power (R/W) 
See Section 15.10.3, “Package RAPL Domain.” 
47 Reserved. 
54:48 Maximum Time Window (R/W) 
Specified by 2“Y * (1.0 + 2/4.0) * Time_Unit, where “Y” is the unsigned 
integer value represented by bits 52:48, “2” is an unsigned integer 
represented by bits 54:53. “Time_Unit” is specified by the “Time Units” 
field of MSR_RAPL_POWER_UNIT. 
63:55 Reserved. 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 
DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 632H, 1586 MSR_PKG_C10_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-states. 
63:0 Package C10 Residency Counter (R/O) 
Value since last reset that the entire SOC is in an SOi3 state. Count at the 
same frequency as the TSC. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains." 
Register Address: 641H, 1601 MSR_PP1_ENERGY_STATUS 
PP1 Energy Status (R/O) Package 


Register Address: 64CH, 1612 


MSR_TURBO_ACTIVATION_RATIO 


2-130 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
ConfigTDP Control (R/W) Package 
7:0 MAX_NON_TURBO_RATIO (RW/L) 

System BIOS can program this field. 
30:8 Reserved. 
31 TURBO_ACTIVATION_RATIO_Lock (RW/L) 
When this bit is set, the content of this register is locked until a reset. 
63:32 Reserved. 
Register Address: 64FH, 1615 MSR_CORE_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in Processor Cores (R/W) Package 


(Frequency refers to processor core frequency.) 


0 


PROCHOT Status (RO) 


When set, processor core frequency is reduced below the operating 
system request due to assertion of external PROCHOT. 


Thermal Status (RO) 


When set, frequency is reduced below the operating system request due 
to a thermal event. 


Package-Level Power Limiting PL1 Status (RO) 


When set, frequency is reduced below the operating system request due 
to package-level power limiting PL1. 


Package-Level PL2 Power Limiting Status (RO) 


When set, frequency is reduced below the operating system request due 
to package-level power limiting PL2. 


Reserved. 


Core Power Limiting Status (RO) 


When set, frequency is reduced below the operating system request due 
to domain-level power limiting. 


VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system request due 
to a thermal alert from the Voltage Regulator. 


Max Turbo Limit Status (RO) 


When set, frequency is reduced below the operating system request due 
to multi-core turbo limits. 


Electrical Design Point Status (RO) 


When set, frequency is reduced below the operating system request due 
to electrical design point constraints (e.g., maximum electrical current 
consumption). 


Turbo Transition Attenuation Status (RO) 


When set, frequency is reduced below the operating system request due 
to Turbo transition attenuation. This prevents performance degradation 
due to frequent operating ratio changes. 


Maximum Efficiency Frequency Status (RO) 


When set, frequency is reduced below the maximum efficiency frequency. 


Reserved. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


16 PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted since the 
log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


17 Thermal Log 


When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


18 Package-Level PL1 Power Limiting Log 


When set, indicates that the Package Level PL1 Power Limiting Status bit 
has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


19 Package-Level PL2 Power Limiting Log 


When set, indicates that the Package Level PL2 Power Limiting Status bit 
has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


24:20 Reserved. 


25 Core Power Limiting Log 


When set, indicates that the Core Power Limiting Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


26 VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


27 Max Turbo Limit Log 


When set, indicates that the Max Turbo Limit Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


28 Electrical Design Point Log 


When set, indicates that the EDP Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing O. 


29 Turbo Transition Attenuation Log 


When set, indicates that the Turbo Transition Attenuation Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


30 Maximum Efficiency Frequency Log 


When set, indicates that the Maximum Efficiency Frequency Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


63:31 Reserved. 


Register Address: 680H, 1664 MSR_LASTBRANCH_O_FROM_IP 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Last Branch Record 0 From IP (R/W) Core 


One of 32 pairs of last branch record registers on the last branch record stack. The From_IP part of the stack contains 
pointers to the source instruction. See also: 


* Last Branch Record Stack TOS at 1CSH. 
= Section 18.6 and record format in Section 18.4.8.1. 


0:47 From Linear Address (R/W) 

62:48 Signed extension of bits 47:0. 

63 Mispred 

Register Address: 681H, 1665 MSR_LASTBRANCH_1_FROM_IP 

Last Branch Record 1 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 682H, 1666 MSR_LASTBRANCH_2_FROM_IP 

Last Branch Record 2 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 683H, 1667 MSR_LASTBRANCH_3_FROM_IP 

Last Branch Record 3 From IP (R/W) Core 


See description of MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 684H, 1668 MSR_LASTBRANCH_4_FROM_IP 


Last Branch Record 4 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 685H, 1669 MSR_LASTBRANCH_5_FROM_IP 


Last Branch Record 5 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 686H, 1670 MSR_LASTBRANCH_6_FROM_IP 

Last Branch Record 6 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 687H, 1671 MSR_LASTBRANCH_7_FROM_IP 

Last Branch Record 7 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 688H, 1672 MSR_LASTBRANCH_8_FROM_IP 

Last Branch Record 8 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 689H, 1673 MSR_LASTBRANCH_9_FROM_IP 

Last Branch Record 9 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68AH, 1674 MSR_LASTBRANCH_10_FROM_IP 

Last Branch Record 10 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68BH, 1675 MSR_LASTBRANCH_11_FROM_IP 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Last Branch Record 11 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68CH, 1676 MSR_LASTBRANCH_12_FROM_IP 

Last Branch Record 12 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68DH, 1677 MSR_LASTBRANCH_13_FROM_IP 

Last Branch Record 13 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68EH, 1678 MSR_LASTBRANCH_14_FROM_IP 

Last Branch Record 14 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68FH, 1679 MSR_LASTBRANCH_15_FROM_IP 

Last Branch Record 15 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 690H, 1680 MSR_LASTBRANCH_16_FROM_IP 

Last Branch Record 16 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 691H, 1681 MSR_LASTBRANCH_17_FROM_IP 

Last Branch Record 17 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 692H, 1682 MSR_LASTBRANCH_18_FROM_IP 

Last Branch Record 18 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 693H, 1683 MSR_LASTBRANCH_19_FROM_IP 

Last Branch Record 19From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 694H, 1684 MSR_LASTBRANCH_20_FROM_IP 

Last Branch Record 20 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 695H, 1685 MSR_LASTBRANCH_21_FROM_IP 

Last Branch Record 21 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 696H, 1686 MSR_LASTBRANCH_22_FROM_IP 

Last Branch Record 22 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 697H, 1687 MSR_LASTBRANCH_23_FROM_IP 

Last Branch Record 23 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 698H, 1688 MSR_LASTBRANCH_24_FROM_IP 


2-134 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Last Branch Record 24 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 699H, 1689 MSR_LASTBRANCH_25_FROM_IP 

Last Branch Record 25 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69AH, 1690 MSR_LASTBRANCH_26_FROM_IP 

Last Branch Record 26 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69BH, 1691 MSR_LASTBRANCH_27_FROM_IP 

Last Branch Record 27 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69CH, 1692 MSR_LASTBRANCH_28_FROM_IP 

Last Branch Record 28 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69DH, 1693 MSR_LASTBRANCH_29_FROM_IP 

Last Branch Record 29 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69EH, 1694 MSR_LASTBRANCH_30_FROM_IP 

Last Branch Record 30 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69FH, 1695 MSR_LASTBRANCH_31_FROM_IP 

Last Branch Record 31 From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 6COH, 1728 MSR_LASTBRANCH_O_TO_IP 

Last Branch Record 0 To IP (R/W) Core 
One of 32 pairs of last branch record registers on the last branch record stack. The To_IP part of the stack contains 
pointers to the Destination instruction and elapsed cycles from last LBR update. See Section 18.6. 

0:47 Target Linear Address (R/W) 

63:48 Elapsed cycles from last update to the LBR. 

Register Address: 6C1H, 1729 MSR_LASTBRANCH_1_TO_IP 

Last Branch Record 1 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C2H, 1730 MSR_LASTBRANCH_2_TO_IP 

Last Branch Record 2 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C3H, 1731 MSR_LASTBRANCH_3_TO_IP 

Last Branch Record 3 To IP (R/W) Core 


See description of MSR_LASTBRANCH_O_TO_IP. 


Register Address: 6C4H, 1732 


MSR_LASTBRANCH_4_TO_IP 


Vol.4 2-135 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Last Branch Record 4 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C5H, 1733 MSR_LASTBRANCH_5_TO_IP 

Last Branch Record 5 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C6H, 1734 MSR_LASTBRANCH_6_TO_IP 

Last Branch Record 6 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C7H, 1735 MSR_LASTBRANCH_7_TO_IP 

Last Branch Record 7 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C8H, 1736 MSR_LASTBRANCH_8_TO_IP 

Last Branch Record 8 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C9H, 1737 MSR_LASTBRANCH_93_TO_IP 

Last Branch Record 9 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CAH, 1738 MSR_LASTBRANCH_10_TO_IP 

Last Branch Record 10 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CBH, 1739 MSR_LASTBRANCH_11_TO_IP 

Last Branch Record 11 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CCH, 1740 MSR_LASTBRANCH_12_TO_IP 

Last Branch Record 12 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CDH, 1741 MSR_LASTBRANCH_13_TO_IP 

Last Branch Record 13 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CEH, 1742 MSR_LASTBRANCH_14_TO_IP 

Last Branch Record 14 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CFH, 1743 MSR_LASTBRANCH_15_TO_IP 

Last Branch Record 15 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DOH, 1744 MSR_LASTBRANCH_16_TO_IP 

Last Branch Record 16 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D1H, 1745 MSR_LASTBRANCH_17_TO_IP 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Last Branch Record 17 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D2H, 1746 MSR_LASTBRANCH_18_TO_IP 

Last Branch Record 18 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D3H, 1747 MSR_LASTBRANCH_19_TO_IP 

Last Branch Record 19To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D4H, 1748 MSR_LASTBRANCH_20_TO_IP 

Last Branch Record 20 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D5H, 1749 MSR_LASTBRANCH_21_TO_IP 

Last Branch Record 21 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D6H, 1750 MSR_LASTBRANCH_22_TO_IP 

Last Branch Record 22 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D7H, 1751 MSR_LASTBRANCH_23_TO_IP 

Last Branch Record 23 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D8H, 1752 MSR_LASTBRANCH_24_TO_IP 

Last Branch Record 24 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D9H, 1753 MSR_LASTBRANCH_25_TO_IP 

Last Branch Record 25 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DAH, 1754 MSR_LASTBRANCH_26_TO_IP 

Last Branch Record 26 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DBH, 1755 MSR_LASTBRANCH_27_TO_IP 

Last Branch Record 27 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DCH, 1756 MSR_LASTBRANCH_28_TO_IP 

Last Branch Record 28 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DDH, 1757 MSR_LASTBRANCH_29_TO_IP 

Last Branch Record 29 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DEH, 1758 MSR_LASTBRANCH_30_TO_IP 


Vol.4 2-137 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 
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Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Last Branch Record 30 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6DFH, 1759 MSR_LASTBRANCH_31_TO_IP 

Last Branch Record 31 To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 802H, 2050 IA32_X2APIC_APICID 

x2APIC ID register (R/O) Core 
Register Address: 803H, 2051 IA32_X2APIC_VERSION 

x2APIC Version register (R/O) Core 
Register Address: 808H, 2056 IA32_X2APIC_TPR 

x2APIC Task Priority register (R/W) Core 
Register Address: 80AH, 2058 IA32_X2APIC_PPR 

x2APIC Processor Priority register (R/O) Core 
Register Address: 80BH, 2059 IA32_X2APIC_EOI 

x2APIC EOI register (W/O) Core 
Register Address: 80DH, 2061 IA32_X2APIC_LDR 

x2APIC Logical Destination register (R/O) Core 
Register Address: 80FH, 2063 IA32_X2APIC_SIVR 

x2APIC Spurious Interrupt Vector register (R/W) Core 
Register Address: 810H, 2064 IA32_X2APIC_ISRO 

x2APIC In-Service register bits [31:0] (R/O) Core 
Register Address: 811H, 2065 IA32_X2APIC_ISR1 

x2APIC In-Service register bits [63:32] (R/O) Core 
Register Address: 812H, 2066 IA32_X2APIC_ISR2 

X2APIC In-Service register bits [95:64] (R/O) Core 
Register Address: 813H, 2067 IA32_X2APIC_ISR3 

x2APIC In-Service register bits [127:96] (R/O) Core 
Register Address: 814H, 2068 IA32_X2APIC_ISR4 

x2APIC In-Service register bits [159:128] (R/O) Core 
Register Address: 815H, 2069 IA32_X2APIC_ISR5 

x2APIC In-Service register bits [191:160] (R/O) Core 
Register Address: 816H, 2070 IA32_X2APIC_ISR6 

x2APIC In-Service register bits [223:192] (R/O) Core 
Register Address: 817H, 2071 IA32_X2APIC_ISR7 

x2APIC In-Service register bits [255:224] (R/O) Core 
Register Address: 818H, 2072 IA32_X2APIC_TMRO 

x2APIC Trigger Mode register bits [31:0] (R/O) Core 


Register Address: 819H, 2073 
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Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
x2APIC Trigger Mode register bits [63:32] (R/O) Core 
Register Address: 81AH, 2074 1A32_X2APIC_TMR2 
x2APIC Trigger Mode register bits [95:64] (R/O) Core 
Register Address: 81BH, 2075 1A32_X2APIC_TMR3 
x2APIC Trigger Mode register bits [127:96] (R/O) Core 
Register Address: 81CH, 2076 1A32_X2APIC_TMR4 
x2APIC Trigger Mode register bits [159:128] (R/O) Core 
Register Address: 81DH, 2077 IA32_X2APIC_TMR5 
x2APIC Trigger Mode register bits [191:160] (R/O) Core 
Register Address: 81H, 2078 IA32_X2APIC_TMR6 
x2APIC Trigger Mode register bits [223:192] (R/O) Core 
Register Address: 81FH, 2079 IA32_X2APIC_TMR7 
x2APIC Trigger Mode register bits [255:224] (R/O) Core 
Register Address: 820H, 2080 IA32_X2APIC_IRRO 
x2APIC Interrupt Request register bits [31:0] (R/O) Core 
Register Address: 821H, 2081 1A32_X2APIC_IRR1 
x2APIC Interrupt Request register bits [63:32] (R/O) Core 
Register Address: 822H, 2082 IA32_X2APIC_IRR2 
x2APIC Interrupt Request register bits [95:64] (R/O) Core 
Register Address: 823H, 2083 IA32_X2APIC_IRR3 
x2APIC Interrupt Request register bits [127:96] (R/O) Core 
Register Address: 824H, 2084 IA32_X2APIC_IRR4 
x2APIC Interrupt Request register bits [159:128] (R/O) Core 
Register Address: 825H, 2085 IA32_X2APIC_IRR5 
x2APIC Interrupt Request register bits [191:160] (R/O) Core 
Register Address: 826H, 2086 IA32_X2APIC_IRR6 
x2APIC Interrupt Request register bits [223:192] (R/O) Core 
Register Address: 827H, 2087 IA32_X2APIC_IRR7 
x2APIC Interrupt Request register bits [255:224] (R/O) Core 
Register Address: 828H, 2088 IA32_X2APIC_ESR 
x2APIC Error Status register (R/W) Core 
Register Address: 82FH, 2095 1A32_X2APIC_LVT_CMCI 
X2APIC LVT Corrected Machine Check Interrupt register (R/W) Core 
Register Address: 830H, 2096 IA32_X2APIC_ICR 
x2APIC Interrupt Command register (R/W) Core 
Register Address: 832H, 2098 IA32_X2APIC_LVT_TIMER 
X2APIC LVT Timer Interrupt register (R/W) Core 
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Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 833H, 2099 IA32_X2APIC_LVT_THERMAL 
x2APIC LVT Thermal Sensor Interrupt register (R/W) Core 
Register Address: 834H, 2100 IA32_X2APIC_LVT_PMI 
x2APIC LVT Performance Monitor register (R/W) Core 
Register Address: 835H, 2101 IA32_X2APIC_LVT_LINTO 
X2APIC LVT LINTO register (R/W) Core 
Register Address: 836H, 2102 IA32_X2APIC_LVT_LINT1 
X2APIC LVT LINT1 register (R/W) Core 
Register Address: 837H, 2103 IA32_X2APIC_LVT_ERROR 
x2APIC LVT Error register (R/W) Core 
Register Address: 838H, 2104 IA32_X2APIC_INIT_COUNT 
X2APIC Initial Count register (R/W) Core 
Register Address: 839H, 2105 IA32_X2APIC_CUR_COUNT 
x2APIC Current Count register (R/O) Core 
Register Address: 83EH, 2110 IA32_X2APIC_DIV_CONF 
x2APIC Divide Configuration register (R/W) Core 
Register Address: 83FH, 2111 IA32_X2APIC_SELF_IPI 
x2APIC Self IPI register (W/O) Core 
Register Address: C8FH, 3215 IA32_PQR_ASSOC 
Resource Association Register (R/W) Core 
31:0 Reserved. 
33:32 COS (R/W) 
63: 34 Reserved. 
Register Address: D10H, 3344 IA32_L2_QOS_MASK_0O 
L2 Class Of Service Mask - COS O (R/W) Module 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=0. 
0:7 CBM: Bit vector of available L2 ways for COS O enforcement. 
63:8 Reserved. 
Register Address: D11H, 3345 IA32_L2_QOS_MASK_1 
L2 Class Of Service Mask - COS 1 (R/W) Module 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=1. 
0:7 CBM: Bit vector of available L2 ways for COS O enforcement. 
63:8 Reserved. 
Register Address: D12H, 3346 IA32_L2_QOS_MASK_2 
L2 Class Of Service Mask - COS 2 (R/W) Module 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=2. 
0:7 CBM: Bit vector of available L2 ways for COS O enforcement. 
63:8 Reserved. 
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Table 2-12. MSRs in Intel Atom® Processors Based on Goldmont Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: D13H, 3347 IA32_L2_QOS_MASK_3 
L2 Class Of Service Mask - COS 3 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=3. 
0:19 CBM: Bit vector of available L2 ways for COS 3 enforcement. 
63:20 Reserved. 
Register Address: DSOH, 3472 IA32_BNDCFGS 
See Table 2-2. Core 
Register Address: DAOH, 3488 IA32_XSS 
See Table 2-2. Core 
See Table 2-6, and Table 2-12 for MSR definitions applicable to processors with a CPUID Signature DisplayFamily_DisplayModel value 
of O6_5CH. 


2.6 MSRS IN INTEL ATOM® PROCESSORS BASED ON GOLDMONT PLUS 
MICROARCHITECTURE 


Intel Atom processors based on the Goldmont Plus microarchitecture support MSRs listed in Table 2-6, Table 2-12, 
and Table 2-13. These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_7AH; see Table 
2-1. For an MSR listed in Table 2-13 that also appears in the model-specific tables of prior generations, Table 2-13 
supersede prior generation tables. 


In the Goldmont Plus microarchitecture, the scope column indicates the following: “Core” means each processor 
core has a separate MSR, or a bit field not shared with another processor core. “Module” means the MSR or the bit 
field is shared by a subset of the processor cores in the physical package. The number of processor cores in this 
subset is model specific and may differ between different processors. For all processors based on Goldmont Plus 
microarchitecture, the L2 cache is also shared between cores in a module and thus CPUID leaf 04H enumeration 
can be used to figure out which processors are in the same module. “Package” means all processor cores in the 
physical package share the same MSR or bit interface. 


Table 2-13. MSRs in Intel Atom? Processors Based on Goldmont Plus Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64Processor (R/W) Core 
See Table 2-2. 
0 Lock (R/WL) 
1 Enable VMX inside SMX operation (R/WL) 
2 Enable VMX outside SMX operation (R/WL) 
14:8 SENTER local functions enables (R/WL) 
15 SENTER global functions enable (R/WL) 
17 SGX Launch Control Enable (R/WL) 
This bit must be set to enable runtime reconfiguration of SGX Launch 
Control via |A32_SGXLEPUBKEYHASHn MSR. 
Valid if CPUID(EAX=07H, ECX=0H): ECX[30] = 1. 
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Table 2-13. MSRs in Intel Atom® Processors Based on Goldmont Plus Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

18 SGX global functions enable (R/WL) 

63:19 Reserved. 

Register Address: 8CH, 140 IA32_SGXLEPUBKEYHASHO 

See Table 2-2. Core 

Register Address: 8DH, 141 IA32_SGXLEPUBKEYHASH1 

See Table 2-2. Core 

Register Address: 8EH, 142 IA32_SGXLEPUBKEYHASH2 

See Table 2-2. Core 

Register Address: 8FH, 143 IA32_SGXLEPUBKEYHASH3 

See Table 2-2. Core 

Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 

(R/W) See Table 2-2. See Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Core 

0 Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMCO. 

1 Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMC1. 

2 Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMC2. 

3 Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMC3. 

31:4 Reserved. 

32 Enable PEBS trigger and recording for |A32_FIXED_CTRO. 

33 Enable PEBS trigger and recording for IA32_FIXED_CTR1. 

34 Enable PEBS trigger and recording for IA32_FIXED_CTR2. 

63:35 Reserved. 

Register Address: 570H, 1392 IA32_RTIT_CTL 

Trace Control Register (R/W) Core 

0 TraceEn 

1 CYCEn 

2 Os 

3 User 

4 Pwr€vtEn 

5 FUPonPTW 

6 FabricEn 

7 CR3Filter 

8 ToPA 
Writing O will #GP if also setting TraceEn. 

9 MTCEn 

10 TSCEn 
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Table 2-13. MSRs in Intel Atom® Processors Based on Goldmont Plus Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
11 DisRETC 
12 PTWEn 
13 BranchEn 
17:14 MTCFreq 
18 Reserved, must be zero. 
22:19 CycThresh 
23 Reserved, must be zero. 
27:24 PSBFreq 
31:28 Reserved, must be zero. 
35:32 ADDRO_CFG 
39:36 ADDR1_CFG 
63:40 Reserved, must be zero. 
Register Address: 680H, 1664 MSR_LASTBRANCH_O_FROM_IP 
Last Branch Record O From IP (R/W) Core 
One of the three MSRs that make up the first entry of the 32-entry LBR stack. The From_IP part of the stack contains 
pointers to the source instruction. See also: 
* Last Branch Record Stack TOS at 1C9SH. 
* Section 18.7, “Last Branch, Call Stack, Interrupt, and Exception Recording for Processors based on Goldmont Plus 
Microarchitecture.” 
Register Address: 681H—69FH, 1665— | MSR_LASTBRANCH_i_FROM_IP 
1695 
Last Branch Record i From IP (R/W) Core 
See description of MSR_LASTBRANCH_O_FROM_IP; j= 1-31. 
Register Address: 6COH, 1728 MSR_LASTBRANCH_O_TO_IP 
Last Branch Record 0 To IP (R/W) Core 
One of the three MSRs that make up the first entry of the 32-entry LBR stack. The To_IP part of the stack contains 
pointers to the Destination instruction. See also: 
* Section 18.7, “Last Branch, Call Stack, Interrupt, and Exception Recording for Processors based on Goldmont Plus 
Microarchitecture.” 
Register Address: 6C1H—6DFH, 1729— | MSR_LASTBRANCH_/_TO_IP 
1759 
Last Branch Record i To IP (R/W) Core 
See description of MSR_LASTBRANCH_O_TO_IP; j = 1-31. 
Register Address: DCOH, 3520 MSR_LASTBRANCH_INFO_O 
Last Branch Record 0 Additional Information (R/w) Core 
One of the three MSRs that make up the first entry of the 32-entry LBR stack. This part of the stack contains flag and 
elapsed cycle information. See also: 
* Last Branch Record Stack TOS at 1CSH. 
* Section 18.9.1, “LBR Stack." 
Register Address: DC1H, 3521 MSR_LASTBRANCH_INFO_1 
Last Branch Record 1 Additional Information (R/W) Core 
See description of MSR_LASTBRANCH_INFO_O. 
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Table 2-13. MSRs in Intel Atom® Processors Based on Goldmont Plus Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: DC2H, 3522 


MSR_LASTBRANCH_INFO_2 


Last Branch Record 2 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DC3H, 3523 


MSR_LASTBRANCH_INFO_3 


Last Branch Record 3 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DC4H, 3524 


MSR_LASTBRANCH_INFO_4 


Last Branch Record 4 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


MSR_LASTBRANCH_INFO_5 


Register Address: DC5H, 3525 


Last Branch Record 5 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DC6H, 3526 


MSR_LASTBRANCH_INFO_6 


Last Branch Record 6 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


MSR_LASTBRANCH_INFO_7 


Register Address: DC7H, 3527 


Last Branch Record 7 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DC8H, 3528 


MSR_LASTBRANCH_INFO_8 


Last Branch Record 8 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCSH, 3529 


MSR_LASTBRANCH_INFO_9 


Last Branch Record 9 Additional Informati 


on (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCAH, 3530 


MSR_LASTBRANCH_INFO_10 


Last Branch Record 10 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCBH, 3531 


MSR_LASTBRANCH_INFO_11 


Last Branch Record 11 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCCH, 3532 


MSR_LASTBRANCH_INFO_12 


Last Branch Record 12 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCDH, 3533 


MSR_LASTBRANCH_INFO_13 


Last Branch Record 13 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DCEH, 3534 


Last Branch Record 14 Additional Informa 


MSR_LASTBRANCH_INFO_14 
tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 
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Table 2-13. MSRs in Intel Atom® Processors Based on Goldmont Plus Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: DCFH, 3535 


MSR_LASTBRANCH_INFO_15 


Last Branch Record 15 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DDOH, 3536 


MSR_LASTBRANCH_INFO_16 


Last Branch Record 16 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD1H, 3537 


MSR_LASTBRANCH_INFO_17 


Last Branch Record 17 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD2H, 3538 


MSR_LASTBRANCH_INFO_18 


Last Branch Record 18 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD3H, 3539 


MSR_LASTBRANCH_INFO_19 


Last Branch Record 19 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD4H, 3520 


MSR_LASTBRANCH_INFO_20 


Last Branch Record 20 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD5H, 3521 


MSR_LASTBRANCH_INFO_21 


Last Branch Record 21 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD6H, 3522 


MSR_LASTBRANCH_INFO_22 


Last Branch Record 22 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD7H, 3523 


MSR_LASTBRANCH_INFO_23 


Last Branch Record 23 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DD8H, 3524 


MSR_LASTBRANCH_INFO_24 


Last Branch Record 24 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DDSH, 3525 


MSR_LASTBRANCH_INFO_25 


Last Branch Record 25 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DDAH, 3526 


MSR_LASTBRANCH_INFO_26 


Last Branch Record 26 Additional Informa 


tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 


Register Address: DDBH, 3527 
Last Branch Record 27 Additional Informa 


MSR_LASTBRANCH_INFO_27 
tion (R/W) 


See description of MSR_LASTBRANCH_INFO_O. 


Core 
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Table 2-13. MSRs in Intel Atom® Processors Based on Goldmont Plus Microarchitecture (Contd.) 
Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: DDCH, 3528 MSR_LASTBRANCH_INFO_28 
Last Branch Record 28 Additional Information (R/W) Core 
See description of MSR_LASTBRANCH_INFO_O. 

Register Address: DDDH, 3529 MSR_LASTBRANCH_INFO_29 
Last Branch Record 29 Additional Information (R/W) Core 
See description of MSR_LASTBRANCH_INFO_O. 

Register Address: DDEH, 3530 MSR_LASTBRANCH_INFO_30 


Last Branch Record 30 Additional Information (R/W) Core 
See description of MSR_LASTBRANCH_INFO_O. 


Register Address: DDFH, 3531 MSR_LASTBRANCH_INFO_31 


Last Branch Record 31 Additional Information (R/W) Core 
See description of MSR_LASTBRANCH_INFO_O. 


See Table 2-6, Table 2-12, and Table 2-13 for MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_7AH. 


2.7 MSRS IN INTEL ATOM® PROCESSORS BASED ON TREMONT 
MICROARCHITECTURE 


Processors based on the Tremont microarchitecture support MSRs listed in Table 2-6, Table 2-12, Table 2-13, and 
Table 2-14. These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_86H, 06_96H, or 
06_9CH; see Table 2-1. For an MSR listed in Table 2-14 that also appears in the model-specific tables of prior 
generations, Table 2-14 supersede prior generation tables. 


In the Tremont microarchitecture, the scope column indicates the following: “Core” means each processor core has 
a separate MSR, or a bit field not shared with another processor core. “Module” means the MSR or the bit field is 
shared by a subset of the processor cores in the physical package. The number of processor cores in this subset is 
model specific and may differ between different processors. For all processors based on Tremont microarchitecture, 
the L2 cache is also shared between cores in a module and thus CPUID leaf 04H enumeration can be used to figure 
out which processors are in the same module. “Package” means all processor cores in the physical package share 
the same MSR or bit interface. 


Table 2-14. MSRs in Intel Atom?’ Processors Based on Tremont Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 33H, 51 MSR_MEMORY_CTRL 
Memory Control Register Core 
28:0 Reserved. 
29 SPLIT_LOCK_DISABLE 


If set to 1, a split lock will cause an #AC(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 


30 Reserved. 
31 Reserved. 
Register Address: CFH, 207 IA32_CORE_CAPABILITIES 
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Table 2-14. MSRs in Intel Atom® Processors Based on Tremont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
IA32 Core Capabilities Register Core 
If CPUID.(EAX=07H, ECX=0):€DX[30] = 1. 

4:0 Reserved. 
5 SPLIT_LOCK_DISABLE_SUPPORTED 
When read as 1, software can set bit 29 of MSR_MEMORY_CTRL (MSR 
address 33H). 
63:6 Reserved. 
Register Address: 2AOH, 672 MSR_PRMRR_BASE_O 
Processor Reserved Memory Range Register - Physical Base Control Register (R/W) Core 
2:0 MEMTYPE: PRMRR BASE Memory Type. 
3 CONFIGURED: PRMRR BASE Configured. 
11:4 Reserved. 
51:12 BASE: PRMRR Base Address. 
63:52 Reserved. 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
(R/W) See Table 2-2. See Section 20.6.2.4, “Processor Event Based Sampling (PEBS).” Core 


n:0 


Enable PEBS trigger and recording for the programmed event (precise or 
otherwise) on |A32_PMCx. The maximum value n can be determined from 
CPUID.OAH:EAX[(1 5:8). 


31:n+1 Reserved. 
32+m32 Enable PEBS trigger and recording for [A32_FIXED_CTRx. The maximum 
value m can be determined from CPUID.OAH:EDX[4:0]. 
59:33+m Reserved. 
60 Pend a PerfMon Interrupt (PMI) after each PEBS event. 
62:61 Specifies PEBS output destination. Encodings: 
OOB: DS Save Area. 
01B: Intel PT trace output. Supported if 
IA32_PERF_CAPABILITIES.PEBS_OUTPUT_PT_AVAIL[16] and 
CPUID.O7H.0.EBX[25] are set. 
10B: Reserved. 
11B: Reserved. 
63 Reserved. 


Register Address: 1309H—130BH, 
4873—4875 


MSR_RELOAD_FIXED_CTRx 


Reload value for [A32_FIXED_CTRx (R/W) 
47:0 


Value loaded into [A32_FIXED_CTRx when a PEBS record is generated 
while PEBS_EN_FIXEDx = 1 and PEBS_OUTPUT = 01B in 
IA32_PEBS_ENABLE, and FIXED_CTRx is overflowed. 


63:48 


Reserved. 


Register Address: 14C1H—14C4H, 
5313-5316 


MSR_RELOAD_PMCx 
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Table 2-14. MSRs in Intel Atom® Processors Based on Tremont Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Reload value for [A32_PMCx (R/W) 


Core 


47:0 


Value loaded into IA32_PMCx when a PEBS record is generated while 
PEBS_EN_PMCx = 1 and PEBS_OUTPUT = 018B in IA32_PEBS_ENABLE, 
and PMCx is overflowed. 


63:48 


Reserved. 


See Table 2-6, Table 2-12, Table 2-13, and Table 2-14 for MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_86H. 


2.8 MSRS IN PROCESSORS BASED ON NEHALEM MICROARCHITECTURE 


Table 2-15 lists model-specific registers (MSRs) that are common for Nehalem microarchitecture. These include the 
Intel Core i7 and i5 processor family. These processors have a CPUID Signature DisplayFamily_DisplayModel value 


of 06_1AH, 06_1EH, 06_1FH, or 06_2EH; see Table 2-1. Additional MSRs specific to processors with a CPUID 


Signature DisplayFamily_DisplayModel value of 06_1AH, 06_1EH, or 06_1FH are listed in Table 2-16. Some MSRs 


listed in these tables are used by BIOS. More information about these MSR can be found at http://biosbits.org. 


The column “Scope” represents the package/core/thread scope of individual bit field of an MSR. “Thread” means 


this bit field must be programmed on each logical processor independently. “Core” means the bit field must be 


programmed on each processor core independently, logical processors in the same core will be affected by change 
of this bit on the other logical processor in the same core. “Package” means the bit field must be programmed once 
for each physical package. Change of a bit filed with a package scope will affect all logical processors in that phys- 


ical package. 


Table 2-15. MSRs in Processors Based on Nehalem Microarchitecture 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: OH, O IA32_P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors.” Thread 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors.” Thread 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Thread 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and Table 2-2. Thread 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Package 
See Table 2-2. 
Register Address: 17H, 23 MSR_PLATFORM_ID 
Model Specific Platform ID (R) Package 
49:0 Reserved. 
52:50 See Table 2-2. 
63:53 Reserved. 


Register Address: 1BH, 27 


IA32_APIC_BASE 
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Table 2-15. MSRs in Processors Based on Nehalem Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Thread 
Register Address: 34H, 52 MSR_SMI_COUNT 
SMI Counter (R/O) Thread 
31:0 SMI Count (R/O) 

Running count of SMI events since last RESET. 
63:32 Reserved. 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64Processor (R/W) Thread 
See Table 2-2. 
Register Address: 79H, 121 IA32_BlOS_UPDT_TRIG 
BIOS Update Trigger Register (W) Core 
See Table 2-2. 
Register Address: 8BH, 139 IA32_BIOS_SIGN_ID 
BIOS Update Signature ID (R/W) Thread 
See Table 2-2. 
Register Address: C1H, 193 IA32_PMCO 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C3H, 195 IA32_PMC2 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C4H, 196 IA32_PMC3 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the frequency that invariant TSC runs at. The invariant 
TSC frequency can be computed by multiplying this ratio by 133.33 MHz. 
27:16 Reserved. 
28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to 0, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 
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Table 2-15. MSRs in Processors Based on Nehalem Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


ACPI C-States. See http://biosbits.org. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 


Register Information / Bit Fields Bit Description Scope 

29 Programmable TDC-TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDC and TDP Limits for Turbo mode are 
programmable. When set to 0, indicates TDC and TDP Limits for Turbo 
mode are not programmable. 

39:30 Reserved. 

47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 133.33MHz. 

63:48 Reserved. 

Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 

C-State Configuration Control (R/W) Core 


2:0 


Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 


The following C-state code name encodings are supported: 
OOOb: CO (no package C-sate support) 

001b: C1 (Behavior is the same as OO00b) 

010b: C3 

011b: C6 

100b: C7 

101b and 110b: Reserved 

111: No package C-state limit. 

Note: This field cannot be used to limit package C-state to C3. 


9:3 Reserved. 

10 I/O MWAIT Redirection Enable (R/W) 
When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 

14:11 Reserved. 

15 CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 

23:16 Reserved. 

24 Interrupt filtering enable (R/w) 
When set, processor cores in a deep C-State will wake only when the event 
message is destined for that core. When 0, all processor cores in a deep C- 
State will wake for an event message. 

25 C3 state auto demotion enable (R/W) 


When set, the processor will conditionally demote C6/C7 requests to C3 
based on uncore auto-demote information. 
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Table 2-15. MSRs in Processors Based on Nehalem Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
26 C1 state auto demotion enable (R/W) 


When set, the processor will conditionally demote C3/C6/C7 requests to C1 
based on uncore auto-demote information. 


27 Enable C3 Undemotion (R/W) 

28 Enable C1 Undemotion (R/W) 

29 Package C State Demotion Enable (R/W) 

30 Package C State Undemotion Enable (R/W) 

63:31 Reserved. 

Register Address: E4H, 228 MSR_PMG_IO_CAPTURE_BASE 

Power Management IO Redirection in C-state (R/W) Core 
See http://biosbits.org. 

15:0 LVL_2 Base Address (R/W) 


Specifies the base address visible to software for IO redirection. If 10 
MWAIT Redirection is enabled, reads to this address will be consumed by 
the power management logic and decoded to MWAIT instructions. When IO 
port address redirection is enabled, this is the |O port address reported to 
the OS/software. 


18:16 C-state Range (R/W) 


Specifies the encoding value of the maximum C-State code name to be 
included when IO read to MWAIT redirection is enabled by 
MSR_PKG_CST_CONFIG_CONTROL[bit1 0}: 


000b - C3 is the max C-State to include. 
001b - C6 is the max C-State to include. 
010b - C7 is the max C-State to include. 


63:19 Reserved. 

Register Address: E7H, 231 IA32_MPERF 

Maximum Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 

Register Address: E8H, 232 IA32_APERF 

Actual Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 

Register Address: FEH, 254 IA32_MTRRCAP 

See Table 2-2. Thread 
Register Address: 174H, 372 IA32_SYSENTER_CS 

See Table 2-2. Thread 
Register Address: 175H, 373 IA32_SYSENTER_ESP 

See Table 2-2. Thread 
Register Address: 176H, 374 IA32_SYSENTER_EIP 

See Table 2-2. Thread 
Register Address: 1 79H, 377 IA32_MCG_CAP 

See Table 2-2. Thread 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Thread 


0 


RIPV 


When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) can 
be used to restart the program. If cleared, the program cannot be reliably 
restarted. 


EIPV 


When set, bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) is 
directly associated with the error. 


2 MCIP 
When set, bit indicates that a machine check has been generated. If a 
second machine check is detected while this bit is still set, the processor 
enters a shutdown state. Software should write this bit to 0 after 
processing a machine check exception. 
63:3 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Thread 
7:0 Event Select 
15:8 UMask 
16 USR 
17 OS 
18 Edge 
19 PC 
20 INT 
21 AnyThread 
22 EN 
23 INV 
31:24 CMASK 
63:32 Reserved. 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Thread 
Register Address: 188H, 392 IA32_PERFEVTSEL2 
See Table 2-2. Thread 
Register Address: 189H, 393 IA32_PERFEVTSEL3 
See Table 2-2. Thread 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. Core 


15:0 


Current Performance State Value. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

63:16 Reserved. 

Register Address: 199H, 409 IA32_PERF_CTL 

See Table 2-2. Thread 

Register Address: 19AH, 410 IA32_CLOCK_MODULATION 

Clock Modulation (R/W) Thread 

See Table 2-2. 

IA32_CLOCK_MODULATION MSR was originally named |[A32_THERM_CONTROL MSR. 

0 Reserved. 

3:1 On demand Clock Modulation Duty Cycle (R/W) 

4 On demand Clock Modulation Enable (R/W) 

63:5 Reserved. 

Register Address: 19BH, 411 IA32_THERM_INTERRUPT 

Thermal Interrupt Control (R/W) Core 

See Table 2-2. 

Register Address: 19CH, 412 IA32_THERM_STATUS 

Thermal Monitor Status (R/W) Core 

See Table 2-2. 

Register Address: 1AQH, 416 IA32_MISC_ENABLE 

Enable Misc. Processor Features (R/W) 

Allows a variety of processor functions to be enabled and disabled. 

0 Fast-Strings Enable Thread 
See Table 2-2. 

2:1 Reserved. 

| Automatic Thermal Control Circuit Enable (R/W) Thread 
See Table 2-2. Default value is 1. 

6:4 Reserved. 
Performance Monitoring Available (R) Thread 
See Table 2-2. 

10:8 Reserved. 

11 Branch Trace Storage Unavailable (R/O) Thread 
See Table 2-2. 

12 Processor Event Based Sampling Unavailable (R/O) Thread 
See Table 2-2. 

15:13 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) Package 
See Table 2-2. 

18 ENABLE MONITOR FSM. (R/W) See Table 2-2. Thread 

21:19 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
22 Limit CPUID Maxval (R/W) Thread 
See Table 2-2. 
23 XTPR Message Disable (R/W) Thread 
See Table 2-2. 
33:24 Reserved. 
34 XD Bit Disable (R/W) Thread 
See Table 2-3. 
37:35 Reserved. 
38 Turbo Mode Disable (R/W) Package 
When set to 1 on processors that support Intel Turbo Boost Technology, 
the turbo mode feature is disabled and the IDA_Enable feature flag will be 
clear (CPUID.OGH: EAX[1]=0). 
When set to a O on processors that support IDA, CPUID.OGH: EAX[1] 
reports the processor's support of turbo mode is enabled. 
Note: The power-on default value is used by BIOS to detect hardware 
support of turbo mode. If the power-on default value is 1, turbo mode is 
available in the processor. If the power-on default value is 0, turbo mode is 
not available. 
63:39 Reserved. 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Thread 
15:0 Reserved. 
23:16 Temperature Target (R) 
The minimum temperature at which PROCHOT# will be asserted. The value 
is degrees C. 
63:24 Reserved. 
Register Address: 1A4H, 420 MSR_MISC_FEATURE_CONTROL 
Miscellaneous Feature Control (R/W) 
0 L2 Hardware Prefetcher Disable (R/w) Core 
If 1, disables the L2 hardware prefetcher, which fetches additional lines of 
code or data into the L2 cache. 
1 L2 Adjacent Cache Line Prefetcher Disable (R/W) Core 
If 1, disables the adjacent cache line prefetcher, which fetches the cache 
line that comprises a cache line pair (128 bytes). 
2 DCU Hardware Prefetcher Disable (R/w) Core 
If 1, disables the L1 data cache prefetcher, which fetches the next cache 
line into L1 data cache. 
3 DCU IP Prefetcher Disable (R/w) Core 
If 1, disables the L1 data cache IP prefetcher, which uses sequential load 
history (based on instruction pointer of previous loads) to determine 
whether to prefetch additional lines. 
63:4 Reserved. 


Register Address: 1A6H, 422 


MSR_OFFCORE_RSP_O 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Offcore Response Event Select Register (R/W) Thread 
Register Address: 1AAH, 426 MSR_MISC_PWR_MGMT 
Miscellaneous Power Management Control 
Various model specific features enumeration. See http://biosbits.org. 

0 EIST Hardware Coordination Disable (R/W) Package 
When 0, enables hardware coordination of Enhanced Intel Speedstep 
Technology request from processor cores. When 1, disables hardware 
coordination of Enhanced Intel Speedstep Technology requests. 

1 Energy/Performance Bias Enable (R/W) Thread 
This bit makes the I[A32_ENERGY_PERF_BIAS register (MSR 1BOh) visible 
to software with Ring 0 privileges. This bit's status (1 or 0) is also reflected 
by CPUID.(EAX=06h):€CX[3]. 

63:2 Reserved. 

Register Address: 1ACH, 428 MSR_TURBO_POWER_CURRENT_LIMIT 

See http://biosbits.org. 

14:0 TDP Limit (R/W) Package 
TDP limit in 1/8 Watt granularity. 

15 TDP Limit Override Enable (R/W) Package 
A value = 0 indicates override is not active; a value = 1 indicates override is 
active. 

30:16 TDC Limit (R/W) Package 
TDC limit in 1/8 Amp granularity. 

31 TDC Limit Override Enable (R/W) Package 
A value = 0 indicates override is not active; a value = 1 indicates override is 
active. 

63:32 Reserved. 

Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO[28] = 0. 

R/W if MSR_PLATFORM_INFO.[28] = 1. 

7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 

63:32 Reserved. 

Register Address: 1C8H, 456 MSR_LBR_SELECT 
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Table 2-15. MSRs in Processors Based on Nehalem Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 


Register Information / Bit Fields Bit Description Scope 
Last Branch Record Filtering Select Register (R/W) Core 
See Section 18.9.2, “Filtering of Last Branch Records.” 

0 CPL_EQ_O 

1 CPL_NEQ_O 

2 JCC 

3 NEAR_REL_CALL 

4 NEAR_IND_CALL 

5 NEAR_RET 

6 NEAR_IND_JMP 

7 NEAR_REL_JMP 

8 FAR_BRANCH 

63:9 Reserved. 

Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 

Last Branch Record Stack TOS (R/W) Thread 
Contains an index (bits 0-3) that points to the MSR containing the most recent branch record. 

See MSR_LASTBRANCH_O_FROM_IP (at 680H). 

Register Address: 1D9H, 473 IA32_DEBUGCTL 

Debug Control (R/W) Thread 
See Table 2-2. 

Register Address: 1DDH, 477 MSR_LER_FROM_LIP 

Last Exception Record From Linear IP (R) Thread 


Register Address: 1DEH, 478 MSR_LER_TO_LIP 
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Last Exception Record To Linear IP (R) Thread 
This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 
Register Address: 1F2H, 498 IA32_SMRR_PHYSBASE 
See Table 2-2. Core 
Register Address: 1F3H, 499 IA32_SMRR_PHYSMASK 
See Table 2-2. Core 
Register Address: 1FCH, 508 MSR_POWER_CTL 
Power Control Register Core 
See http://biosbits.org. 
0 Reserved. 
1 C1E Enable (R/W) Package 
When set to ‘1’, will enable the CPU to switch to the Minimum Enhanced 
Intel SpeedStep Technology operating point when all execution cores enter 
MWAIT (C1). 
63:2 Reserved. 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

See Table 2-2. Thread 
Register Address: 201H, 513 1A32_MTRR_PHYSMASKO 

See Table 2-2. Thread 
Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 

See Table 2-2. Thread 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 

See Table 2-2. Thread 
Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 

See Table 2-2. Thread 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 

See Table 2-2. Thread 
Register Address: 206H, 518 1A32_MTRR_PHYSBASE3 

See Table 2-2. Thread 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 

See Table 2-2. Thread 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 

See Table 2-2. Thread 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 

See Table 2-2. Thread 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 

See Table 2-2. Thread 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 

See Table 2-2. Thread 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 

See Table 2-2. Thread 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 

See Table 2-2. Thread 
Register Address: 20€H, 526 IA32_MTRR_PHYSBASE7 

See Table 2-2. Thread 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 

See Table 2-2. Thread 
Register Address: 210H, 528 IA32_MTRR_PHYSBASE8 

See Table 2-2. Thread 
Register Address: 211H, 529 IA32_MTRR_PHYSMASK8 

See Table 2-2. Thread 
Register Address: 212H, 530 IA32_MTRR_PHYSBASE9 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Table 2-2. Thread 
Register Address: 213H, 531 IA32_MTRR_PHYSMASK9 
See Table 2-2. Thread 
Register Address: 250H, 592 1A32_MTRR_FIX64K_00000 
See Table 2-2. Thread 
Register Address: 258H, 600 1A32_MTRR_FIX16K_80000 
See Table 2-2. Thread 
Register Address: 259H, 601 1A32_MTRR_FIX16K_A0000 
See Table 2-2. Thread 
Register Address: 268H, 616 1A32_MTRR_FIX4K_CO000 
See Table 2-2. Thread 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Thread 
Register Address: 26AH, 618 IA32_MTRR_FIX4K_D0000 
See Table 2-2. Thread 
Register Address: 26BH, 619 1A32_MTRR_FIX4K_D8000 
See Table 2-2. Thread 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Thread 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Thread 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
See Table 2-2. Thread 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
See Table 2-2. Thread 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Thread 
Register Address: 280H, 640 IA32_MCO_CTL2 
See Table 2-2. Package 
Register Address: 281H, 641 IA32_MC1_CTL2 
See Table 2-2. Package 
Register Address: 282H, 642 IA32_MC2_CTL2 
See Table 2-2. Core 
Register Address: 283H, 643 IA32_MC3_CTL2 
See Table 2-2. Core 
Register Address: 284H, 644 IA32_MC4_CTL2 
See Table 2-2. Core 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 285H, 645 IA32_MC5_CTL2 
See Table 2-2. Core 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 
See Table 2-2. Package 
Register Address: 288H, 648 IA32_MC8_CTL2 
See Table 2-2. Package 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Thread 
See Table 2-2. 
Register Address: 309H, 777 IA32_FIXED_CTRO 
Fixed-Function Performance Counter Register O (R/W) Thread 
See Table 2-2. 
Register Address: 30AH, 778 IA32_FIXED_CTR1 
Fixed-Function Performance Counter Register 1 (R/W) Thread 
See Table 2-2. 
Register Address: 30BH, 779 IA32_FIXED_CTR2 
Fixed-Function Performance Counter Register 2 (R/W) Thread 
See Table 2-2. 
Register Address: 345H, 837 IA32_PERF_CAPABILITIES 
See Table 2-2. See Section 18.4.1, “IA32_DEBUGCTL MSR.” Thread 
5:0 LBR Format 

See Table 2-2. 

PEBS Record Format 

PEBSSaveArchRegs 

See Table 2-2. 
11:8 PEBS_REC_FORMAT 

See Table 2-2. 
12 SMM_FREEZE 

See Table 2-2. 
63:13 Reserved. 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 
Fixed-Function-Counter Control Register (R/W) Thread 
See Table 2-2. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Thread 
Register Address: 38€H, 910 MSR_PERF_GLOBAL_STATUS 
Provides single-bit status used by software to query the overflow condition of each performance counter. (R/O) Thread 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
61 UNC_Ovf 
Uncore overflowed if 1. 
Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Thread 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2. See Section 20.6.2.2, “Global Counter Control Facilities.” Allows software to clear counter overflow Thread 
conditions on any combination of fixed-function PMCs (IA32_FIXED_CTRx) or general-purpose PMCs via a single 
WRMSR. 
Register Address: 390H, 912 MSR_PERF_GLOBAL_OVF_CTRL 
(R/W) Thread 
61 CLR_UNC_Ovf 
Set 1 to clear UNC_Ovf. 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
See Section 20.3.1.1.1, “Processor Event Based Sampling (PEBS).” Thread 
0 Enable PEBS on IA32_PMCO (R/W) 
1 Enable PEBS on IA32_PMC1 (R/W) 
2 Enable PEBS on IA32_PMC2 (R/W) 
3 Enable PEBS on IA32_PMC3 (R/W) 
31:4 Reserved. 
32 Enable Load Latency on IA32_PMCO (R/W) 
33 Enable Load Latency on IA32_PMC1 (R/W) 
34 Enable Load Latency on IA32_PMC2 (R/W) 
35 Enable Load Latency on IA32_PMC3 (R/W) 
63:36 Reserved. 
Register Address: 3F6H, 1014 MSR_PEBS_LD_LAT 
See Section 20.3.1.1.2, “Load Latency Performance Monitoring Facility.” Thread 
15:0 Minimum threshold latency value of tagged load operation that will be 
counted. (R/W) 
63:36 Reserved. 
Register Address: 3F8H, 1016 MSR_PKG_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C3 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C3 states. 
Count at the same frequency as the TSC. 
Register Address: 3F9H, 1017 MSR_PKG_C6_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 


ACPI C-States. 
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63:0 Package C6 Residency Counter (R/O) 


Value since last reset that this package is in processor-specific C6 states. 
Count at the same frequency as the TSC. 


Register Address: 3FAH, 1018 MSR_PKG_C7_RESIDENCY 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 


63:0 Package C7 Residency Counter (R/O) 


Value since last reset that this package is in processor-specific C7 states. 
Count at the same frequency as the TSC. 


Register Address: 3FCH, 1020 MSR_CORE_C3_RESIDENCY 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 


63:0 CORE C3 Residency Counter (R/O) 


Value since last reset that this core is in processor-specific C3 states. Count 
at the same frequency as the TSC. 


Register Address: 3FDH, 1021 MSR_CORE_C6_RESIDENCY 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 


63:0 CORE C6 Residency Counter (R/O) 


Value since last reset that this core is in processor-specific C6 states. Count 
at the same frequency as the TSC. 


Register Address: 400H, 1024 IA32_MCO_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 401H, 1025 1A32_MCO_STATUS 

See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Package 
Register Address: 402H, 1026 IA32_MCO_ADDR 

See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 


The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MCO_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 403H, 1027 IA32_MCO_MISC 

See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 404H, 1028 IA32_MC1_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 405H, 1029 1A32_MC1_STATUS 

See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Package 
Register Address: 406H, 1030 IA32_MC1_ADDR 

See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 


The IA32_MC1_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC1_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description 


Scope 


Register Address: 407H, 1031 IA32_MC1_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 408H, 1032 IA32_MC2_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Core 


Register Address: 409H, 1033 IA32_MC2_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Core 


Register Address: 40AH, 1034 IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC2_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Core 


Register Address: 40BH, 1035 IA32_MC2_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Core 


Register Address: 40CH, 1036 IA32_MC3_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 
Register Address: 40DH, 1037 IA32_MC3_STATUS 


Core 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Core 


Register Address: 40€H, 1038 IA32_MC3_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Core 


Register Address: 40FH, 1039 IA32_MC3_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Core 


Register Address: 410H, 1040 IA32_MC4_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Core 


Register Address: 411H, 1041 IA32_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Core 


Register Address: 412H, 1042 IA32_MC4_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 413H, 1043 IA32_MC4_MISC 


Core 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Core 


Register Address: 414H, 1044 IA32_MC5_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Core 


Register Address: 415H, 1045 IA32_MC5_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Core 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 416H, 1046 IA32_MC5_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 417H, 1047 IA32_MC5_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Register Address: 418H, 1048 IA32_MC6_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 419H, 1049 1A32_MC6_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 41AH, 1050 IA32_MC6_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 41BH, 1051 IA32_MC6_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 41CH, 1052 IA32_MC7_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 41DH, 1053 1A32_MC7_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 41€H, 1054 IA32_MC7_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 41FH, 1055 IA32_MC7_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 420H, 1056 IA32_MC8_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 421H, 1057 1A32_MC8_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 422H, 1058 IA32_MC8_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 423H, 1059 IA32_MC8_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 480H, 1152 IA32_VMX_BASIC 
Reporting Register of Basic VMX Capabilities (R/O) Thread 
See Table 2-2 and Appendix A.1, “Basic VMX Information.” 
Register Address: 481H, 1153 IA32_VMX_PINBASED_CTLS 
Capability Reporting Register of Pin-based VM-execution Controls (R/O) Thread 
See Table 2-2 and Appendix A.3, “VM-Execution Controls.” 
Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 
Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) Thread 
See Appendix A.3, “VM-Execution Controls.” 
Register Address: 483H, 1155 IA32_VMX_EXIT_CTLS 
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Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Capability Reporting Register of VM-Exit Controls (R/O) 
See Table 2-2 and Appendix A.4, “VM-Exit Controls.” 


Thread 


Register Address: 484H, 1156 


IA32_VMX_ENTRY_CTLS 


Capability Reporting Register of VM-Entry Controls (R/O) 
See Table 2-2 and Appendix A.5, “VM-Entry Controls.” 


Thread 


Register Address: 485H, 1157 


1A32_WVMX_MISC 


Reporting Register of Miscellaneous VMX Capabilities (R/O) 
See Table 2-2 and Appendix A.6, “Miscellaneous Data.” 


Thread 


Register Address: 486H, 1158 


IA32_VMX_CRO_FIXEDO 


Capability Reporting Register of CRO Bits 
See Table 2-2 and Appendix A.7, “VMX-Fi 


Fixed to 0 (R/O) 
xed Bits in CRO." 


Thread 


Register Address: 487H, 1159 


IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO Bits 


Fixed to 1 (R/O) 


See Table 2-2 and Appendix A.7, “VMX-Fixed Bits in CRO." 


Thread 


IA32_VMX_CR4_FIXEDO 


Register Address: 488H, 1160 


Capability Reporting Register of CR4 Bits 


Fixed to 0 (R/O) 


See Table 2-2 and Appendix A.8, “VMX-Fixed Bits in CR4." 


Thread 


Register Address: 489H, 1161 


IA32_VWMX_CR4_FIX€D1 


Capability Reporting Register of CR4 Bits 


Fixed to 1 (R/O) 


See Table 2-2 and Appendix A.8, “VMX-Fixed Bits in CR4." 


Thread 


IA32_WMX_VMCS_ENUM 


Register Address: 48AH, 1162 


Capability Reporting Register of VMCS Field Enumeration (R/O) 
See Table 2-2 and Appendix A.9, “VMCS Enumeration.” 


Thread 


Register Address: 48BH, 1163 


IA32_WMX_PROCBASED_CTLS2 


Capability Reporting Register of Seconda 


ry Processor-Based VM-Execution Controls (R/O) 


See Appendix A.3, “VM-Execution Controls.” 


Thread 


Register Address: 600H, 1536 


IA32_DS_AREA 


DS Save Area (R/W) 
See Table 2-2 and Section 20.6.3.4, “Deb 


ug Store (DS) Mechanism.” 


Thread 


Register Address: 680H, 1664 


MSR_LASTBRANCH_O_FROM_IP 


Last Branch Record 0 From IP (R/W) 


« See Section 18.9.1 and record format 


One of sixteen pairs of last branch record registers on the last branch record stack. The From_IP part of the stack 
contains pointers to the source instruction. See also: 


* Last Branch Record Stack TOS at 1C9H. 


in Section 18.4.8.1. 


Thread 


Register Address: 681H, 1665 


MSR_LASTBRANCH_1_FROM_IP 


Last Branch Record 1 From IP (R/W) 
See description of MSR_LASTBRANCH_O 


FROM_IP. 


Thread 


Register Address: 682H, 1666 


MSR_LASTBRANCH_2_FROM_IP 
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Register Information / Bit Fields Bit Description Scope 
Last Branch Record 2 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 683H, 1667 MSR_LASTBRANCH_3_FROM_IP 

Last Branch Record 3 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 684H, 1668 MSR_LASTBRANCH_4_FROM_IP 

Last Branch Record 4 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 685H, 1669 MSR_LASTBRANCH_5_FROM_IP 

Last Branch Record 5 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 686H, 1670 MSR_LASTBRANCH_6_FROM_IP 

Last Branch Record 6 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 687H, 1671 MSR_LASTBRANCH_7_FROM_IP 

Last Branch Record 7 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 688H, 1672 MSR_LASTBRANCH_8_FROM_IP 

Last Branch Record 8 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 689H, 1673 MSR_LASTBRANCH_9_FROM_IP 

Last Branch Record 9 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68AH, 1674 MSR_LASTBRANCH_10_FROM_IP 

Last Branch Record 10 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68BH, 1675 MSR_LASTBRANCH_11_FROM_IP 

Last Branch Record 11 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68CH, 1676 MSR_LASTBRANCH_12_FROM_IP 

Last Branch Record 12 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68DH, 1677 MSR_LASTBRANCH_13_FROM_IP 

Last Branch Record 13 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68EH, 1678 MSR_LASTBRANCH_14_FROM_IP 

Last Branch Record 14 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 68FH, 1679 MSR_LASTBRANCH_15_FROM_IP 
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See description of MSR_LASTBRANCH_O_TO_IP. 


Register Information / Bit Fields Bit Description Scope 
Last Branch Record 15 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 6COH, 1728 MSR_LASTBRANCH_O_TO_IP 

Last Branch Record 0 To IP (R/W) Thread 
One of sixteen pairs of last branch record registers on the last branch record stack. This part of the stack contains 

pointers to the destination instruction. 

Register Address: 6C1H, 1729 MSR_LASTBRANCH_1_TO_IP 

Last Branch Record 1 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C2H, 1730 MSR_LASTBRANCH_2_TO_IP 

Last Branch Record 2 To IP (R/W) Thread 


Last Branch Record 3 To IP (R/W) 
See description of MSR_LASTBRANCH_O_TO_IP. 


Register Address: 6C3H, 1731 MSR_LASTBRANCH_3_TO_IP 


Thread 


Register Address: 6C4H, 1732 MSR_LASTBRANCH_4_TO_IP 


See description of MSR_LASTBRANCH_O_TO_IP. 


Last Branch Record 4 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C5H, 1733 MSR_LASTBRANCH_5_TO_IP 

Last Branch Record 5 To IP (R/W) Thread 


Register Address: 6C6H, 1734 MSR_LASTBRANCH_6_TO_IP 


See description of MSR_LASTBRANCH_O_TO_IP. 


Last Branch Record 6 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C7H, 1735 MSR_LASTBRANCH_7_TO_IP 

Last Branch Record 7 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C8H, 1736 MSR_LASTBRANCH_8_TO_IP 

Last Branch Record 8 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C9H, 1737 MSR_LASTBRANCH_9_TO_IP 

Last Branch Record 9 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CAH, 1738 MSR_LASTBRANCH_10_TO_IP 

Last Branch Record 10 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CBH, 1739 MSR_LASTBRANCH_11_TO_IP 

Last Branch Record 11 To IP (R/W) Thread 
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Register Address: 6CCH, 1740 MSR_LASTBRANCH_12_TO_IP 
Last Branch Record 12 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6CDH, 1741 MSR_LASTBRANCH_13_TO_IP 
Last Branch Record 13 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6CEH, 1742 MSR_LASTBRANCH_14_TO_IP 
Last Branch Record 14 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6CFH, 1743 MSR_LASTBRANCH_15_TO_IP 
Last Branch Record 15 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 802H, 2050 1A32_X2APIC_APICID 
x2APIC ID Register (R/O) Thread 
Register Address: 803H, 2051 IA32_X2APIC_VERSION 
x2APIC Version Register (R/O) Thread 
Register Address: 808H, 2056 IA32_X2APIC_TPR 
x2APIC Task Priority Register (R/W) Thread 
Register Address: 80AH, 2058 IA32_X2APIC_PPR 
x2APIC Processor Priority Register (R/O) Thread 
Register Address: 80BH, 2059 IA32_X2APIC_EOI 
x2APIC EO! Register (W/O) Thread 
Register Address: 80DH, 2061 IA32_X2APIC_LDR 
x2APIC Logical Destination Register (R/O) Thread 
Register Address: 80FH, 2063 IA32_X2APIC_SIVR 
x2APIC Spurious Interrupt Vector Register (R/W) Thread 
Register Address: 810H, 2064 1A32_X2APIC_ISRO 
X2APIC In-Service Register Bits [31:0] (R/O) Thread 
Register Address: 811H, 2065 IA32_X2APIC_ISR1 
x2APIC In-Service Register Bits [63:32] (R/O) Thread 
Register Address: 812H, 2066 IA32_X2APIC_ISR2 
X2APIC In-Service Register Bits [95:64] (R/O) Thread 
Register Address: 813H, 2067 IA32_X2APIC_ISR3 
x2APIC In-Service Register Bits [127:96] (R/O) Thread 
Register Address: 814H, 2068 IA32_X2APIC_ISR4 
x2APIC In-Service Register Bits [159:128] (R/O) Thread 
Register Address: 815H, 2069 1A32_X2APIC_ISR5 
X2APIC In-Service Register Bits [191:160] (R/O) Thread 
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Register Address: 816H, 2070 IA32_X2APIC_ISR6 
x2APIC In-Service Register Bits [223:192] (R/O) Thread 
Register Address: 817H, 2071 IA32_X2APIC_ISR7 
x2APIC In-Service Register Bits [255:224] (R/O) Thread 
Register Address: 818H, 2072 IA32_X2APIC_TMRO 
x2APIC Trigger Mode Register Bits [31:0] (R/O) Thread 
Register Address: 819H, 2073 IA32_X2APIC_TMR1 
x2APIC Trigger Mode Register Bits [63:32] (R/O) Thread 
Register Address: 81AH, 2074 IA32_X2APIC_TMR2 
x2APIC Trigger Mode Register Bits [95:64] (R/O) Thread 
Register Address: 81BH, 2075 IA32_X2APIC_TMR3 
x2APIC Trigger Mode Register Bits [127:96] (R/O) Thread 
Register Address: 81CH, 2076 IA32_X2APIC_TMR4 
x2APIC Trigger Mode Register Bits [159:128] (R/O) Thread 
Register Address: 81DH, 2077 IA32_X2APIC_TMR5 
x2APIC Trigger Mode Register Bits [191:160] (R/O) Thread 
Register Address: 81EH, 2078 IA32_X2APIC_TMR6 
x2APIC Trigger Mode Register Bits [223:192] (R/O) Thread 
Register Address: 81FH, 2079 IA32_X2APIC_TMR7 
x2APIC Trigger Mode Register Bits [255:224] (R/O) Thread 
Register Address: 820H, 2080 IA32_X2APIC_IRRO 
x2APIC Interrupt Request Register Bits [31:0] (R/O) Thread 
Register Address: 821H, 2081 IA32_X2APIC_IRR1 
x2APIC Interrupt Request Register Bits [63:32] (R/O) Thread 
Register Address: 822H, 2082 IA32_X2APIC_IRR2 
x2APIC Interrupt Request Register Bits [95:64] (R/O) Thread 
Register Address: 823H, 2083 IA32_X2APIC_IRR3 
x2APIC Interrupt Request Register Bits [127:96] (R/O) Thread 
Register Address: 824H, 2084 IA32_X2APIC_IRR4 
x2APIC Interrupt Request Register Bits [159:128] (R/O) Thread 
Register Address: 825H, 2085 IA32_X2APIC_IRR5 
x2APIC Interrupt Request Register Bits [191:160] (R/O) Thread 
Register Address: 826H, 2086 IA32_X2APIC_IRR6 
x2APIC Interrupt Request Register Bits [223:192] (R/O) Thread 
Register Address: 827H, 2087 IA32_X2APIC_IRR7 
x2APIC Interrupt Request Register Bits [255:224] (R/O) Thread 
Register Address: 828H, 2088 IA32_X2APIC_ESR 
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Register Information / Bit Fields Bit Description Scope 
x2APIC Error Status Register (R/W) Thread 
Register Address: 82FH, 2095 1A32_X2APIC_LVT_CMCI 
x2APIC LVT Corrected Machine Check Interrupt Register (R/W) Thread 
Register Address: 830H, 2096 IA32_X2APIC_ICR 
x2APIC Interrupt Command Register (R/W) Thread 
Register Address: 832H, 2098 IA32_X2APIC_LVT_TIMER 
x2APIC LVT Timer Interrupt Register (R/W) Thread 
Register Address: 833H, 2099 IA32_X2APIC_LVT_THERMAL 
x2APIC LVT Thermal Sensor Interrupt Register (R/W) Thread 
Register Address: 834H, 2100 IA32_X2APIC_LVT_PMI 
x2APIC LVT Performance Monitor Register (R/W) Thread 
Register Address: 835H, 2101 1A32_X2APIC_LVT_LINTO 
x2APIC LVT LINTO Register (R/W) Thread 
Register Address: 836H, 2102 1A32_X2APIC_LVT_LINT1 
X2APIC LVT LINT1 Register (R/W) Thread 
Register Address: 837H, 2103 IA32_X2APIC_LVT_ERROR 
X2APIC LVT Error Register (R/W) Thread 
Register Address: 838H, 2104 IA32_X2APIC_INIT_COUNT 
X2APIC Initial Count Register (R/W) Thread 
Register Address: 839H, 2105 1A32_X2APIC_CUR_COUNT 
X2APIC Current Count Register (R/O) Thread 
Register Address: 83EH, 2110 IA32_X2APIC_DIV_CONF 
x2APIC Divide Configuration Register (R/W) Thread 
Register Address: 83FH, 2111 IA32_X2APIC_SELF_IPI 
x2APIC Self IPI Register (W/O) Thread 
Register Address: COOO_O080H IA32_EFER 
Extended Feature Enables Thread 
See Table 2-2. 

Register Address: COO0_0081H IA32_STAR 

System Call Target Address (R/W) Thread 
See Table 2-2. 

Register Address: COO0_0082H IA32_LSTAR 

IA-32e Mode System Call Target Address (R/W) Thread 
See Table 2-2. 

Register Address: COO0_0084H IA32_FMASK 

System Call Flag Mask (R/W) Thread 
See Table 2-2. 

Register Address: COO0_0100H IA32_FS_BASE 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See Table 2-2 and Section 18.17.2, "IA32_TSC_AUX Register and RDTSCP Support.” 


Register Information / Bit Fields Bit Description Scope 
Map of BASE Address of FS (R/W) Thread 
See Table 2-2. 

Register Address: CO00_0101H IA32_GS_BASE 

Map of BASE Address of GS (R/W) Thread 
See Table 2-2. 

Register Address: CO00_0102H IA32_KERNEL_GS_BASE 

Swap Target of BASE Address of GS (R/W) Thread 
See Table 2-2. 

Register Address: COO0_0103H IA32_TSC_AUX 

AUXILIARY TSC Signature (R/W) Thread 


2.8.1 Additional MSRs in the Intel® Xeon® Processor 5500 and 3400 Series 


The Intel Xeon Processor 5500 and 3400 series supports additional model-specific registers listed in Table 2-16. 


These MSRs also apply to the Intel Core i7 and i5 processor family with a CPUID Signature 


DisplayFamily_DisplayModel value of 06_1AH, 06_1EH, or 06_1FH; see Table 2-1. 


Table 2-16. Additional MSRs in the Intel® Xeon® Processor 5500 and 3400 Series 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Actual maximum turbo frequency is multiplied by 133.33MHz. Package 
(Not available in model 06_2EH.) 
7:0 Maximum Turbo Ratio Limit 1C (R/O) 
Maximum Turbo mode ratio limit with 1 core active. 
15:8 Maximum Turbo Ratio Limit 2C (R/O) 
Maximum Turbo mode ratio limit with 2 cores active. 
23:16 Maximum Turbo Ratio Limit 3C (R/O) 
Maximum Turbo mode ratio limit with 3 cores active. 
31:24 Maximum Turbo Ratio Limit 4C (R/O) 
Maximum Turbo mode ratio limit with 4 cores active. 
63:32 Reserved. 
Register Address: 301H, 769 MSR_GQ_SNOOP_MESF 
MSR_GQ_SNOOP_MESF Package 


From M to S (R/W) 


From E to S (R/W) 
From S to S (R/W) 


From F to S (R/W) 


0 
1 
2 
3 
4 
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From M to | (R/W) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-16. Additional MSRs in the Intel® Xeon® Processor 5500 and 3400 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
5 From E to | (R/W) 
6 From S to | (R/W) 
7 From F to | (R/W) 
63:8 Reserved. 
Register Address: 391H, 913 MSR_UNCORE_PERF_GLOBAL_CTRL 
See Section 20.3.1.2.1, “Uncore Performance Monitoring Management Facility.” Package 
Register Address: 392H, 914 MSR_UNCORE_PERF_GLOBAL_STATUS 
See Section 20.3.1.2.1, “Uncore Performance Monitoring Management Facility.” Package 
Register Address: 393H, 915 MSR_UNCORE_PERF_GLOBAL_OVF_CTRL 
See Section 20.3.1.2.1, “Uncore Performance Monitoring Management Facility.” Package 
Register Address: 394H, 916 MSR_UNCORE_FIXED_CTRO 
See Section 20.3.1.2.1, “Uncore Performance Monitoring Management Facility.” Package 
Register Address: 395H, 917 MSR_UNCORE_FIXED_CTR_CTRL 
See Section 20.3.1.2.1, “Uncore Performance Monitoring Management Facility.” Package 
Register Address: 396H, 918 MSR_UNCORE_ADDR_OPCODE_MATCH 
See Section 20.3.1.2.3, “Uncore Address/Opcode Match MSR.” Package 
Register Address: 3BOH, 960 MSR_UNCORE_PMCO 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B1H, 961 MSR_UNCORE_PMC1 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B2H, 962 MSR_UNCORE_PMC2 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B3H, 963 MSR_UNCORE_PMC3 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B4H, 964 MSR_UNCORE_PMC4 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B5H, 965 MSR_UNCORE_PMC5 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B6H, 966 MSR_UNCORE_PMC6 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3B7H, 967 MSR_UNCORE_PMC7 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3COH, 944 MSR_UNCORE_PERFEVTSELO 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C1H, 945 MSR_UNCORE_PERFEVTSEL1 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C2H, 946 MSR_UNCORE_PERFEVTSEL2 
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Table 2-16. Additional MSRs in the Intel? Xeon® Processor 5500 and 3400 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C3H, 947 MSR_UNCORE_PERFEVTSEL3 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C4H, 948 MSR_UNCORE_PERFEVTSEL4 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C5H, 949 MSR_UNCORE_PERFEVTSEL5 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C6H, 950 MSR_UNCORE_PERFEVTSEL6 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 
Register Address: 3C7H, 951 MSR_UNCORE_PERFEVTSEL7 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 


2.8.2 Additional MSRs in the Intel® Xeon® Processor 7500 Series 


The Intel Xeon Processor 7500 series supports MSRs listed in Table 2-15 (except MSR address 1ADH) and additional 
model-specific registers listed in Table 2-17. These processors have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_2EH. 


Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Reserved. Attempt to read/write will cause #UD. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 
See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 
See Table 2-2. Package 
Register Address: 28BH, 651 IA32_MC11_CTL2 
See Table 2-2. Package 
Register Address: 28CH, 652 IA32_MC12_CTL2 
See Table 2-2. Package 
Register Address: 28DH, 653 IA32_MC13_CTL2 
See Table 2-2. Package 
Register Address: 28H, 654 IA32_MC14_CTL2 
See Table 2-2. Package 
Register Address: 28FH, 655 IA32_MC15_CTL2 
See Table 2-2. Package 
Register Address: 290H, 656 IA32_MC16_CTL2 
See Table 2-2. Package 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 294H, 660 IA32_MC20_CTL2 
See Table 2-2. Package 
Register Address: 295H, 661 IA32_MC21_CTL2 
See Table 2-2. Package 
Register Address: 394H, 816 MSR_W_PMON_FIXED_CTR 
Uncore W-box perfmon fixed counter. Package 
Register Address: 395H, 817 MSR_W_PMON_FIXED_CTR_CTL 
Uncore U-box perfmon fixed counter control MSR. Package 
Register Address: 424H, 1060 IA32_MC9_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs.” Package 
Register Address: 425H, 1061 IA32_MC9_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 426H, 1062 IA32_MC9_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 427H, 1063 IA32_MC9_MISC 
See Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Register Address: 428H, 1064 IA32_MC10_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 429H, 1065 IA32_MC10_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 42AH, 1066 IA32_MC10_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 42BH, 1067 IA32_MC10_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 42CH, 1068 IA32_MC11_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 42DH, 1069 IA32_MC11_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 42EH, 1070 IA32_MC11_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 42FH, 1071 IA32_MC11_MISC 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 430H, 1072 IA32_MC12_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 431H, 1073 IA32_MC12_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 432H, 1074 IA32_MC12_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 433H, 1075 IA32_MC12_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 434H, 1076 IA32_MC13_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 435H, 1077 IA32_MC13_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 436H, 1078 IA32_MC13_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 437H, 1079 IA32_MC13_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 438H, 1080 IA32_MC14_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 439H, 1081 IA32_MC14_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 43AH, 1082 IA32_MC14_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 43BH, 1083 IA32_MC14_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 43CH, 1084 IA32_MC15_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 43DH, 1085 1A32_MC15_STATUS 
See Section 16.3.2.2, “"IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 43EH, 1086 IA32_MC15_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 43FH, 1087 IA32_MC15_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 440H, 1088 IA32_MC16_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 441H, 1089 IA32_MC16_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-17. Additional MSRs in the Intel? Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 442H, 1090 IA32_MC16_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 443H, 1091 IA32_MC16_MISC 
See Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Register Address: 444H, 1092 IA32_MC17_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs.” Package 
Register Address: 445H, 1093 IA32_MC17_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 446H, 1094 IA32_MC17_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 447H, 1095 IA32_MC17_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 448H, 1096 IA32_MC18_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 449H, 1097 IA32_MC18_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 44AH, 1098 IA32_MC18_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 44BH, 1099 IA32_MC18_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 44CH, 1100 IA32_MC19_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs.” Package 
Register Address: 44DH, 1101 IA32_MC19_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 44EH, 1102 IA32_MC19_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 44FH, 1103 IA32_MC19_MISC 
See Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Register Address: 450H, 1104 IA32_MC20_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 451H, 1105 1A32_MC20_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 452H, 1106 IA32_MC20_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 453H, 1107 IA32_MC20_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 454H, 1108 IA32_MC21_CTL 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 455H, 1109 IA32_MC21_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 456H, 1110 IA32_MC21_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 457H, 1111 IA32_MC21_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: COOH, 3072 MSR_U_PMON_GLOBAL_CTRL 
Uncore U-box perfmon global control MSR. Package 
Register Address: CO1H, 3073 MSR_U_PMON_GLOBAL_STATUS 
Uncore U-box perfmon global status MSR. Package 
Register Address: CO2H, 3074 MSR_U_PMON_GLOBAL_OVF_CTRL 
Uncore U-box perfmon global overflow control MSR. Package 
Register Address: C10H, 3088 MSR_U_PMON_EVNT_SEL 
Uncore U-box perfmon event select MSR. Package 
Register Address: C11H, 3089 MSR_U_PMON_CTR 
Uncore U-box perfmon counter MSR. Package 
Register Address: C20H, 3104 MSR_BO_PMON_BOX_CTRL 
Uncore B-box 0 perfmon local box control MSR. Package 
Register Address: C21H, 3105 MSR_BO_PMON_BOX_STATUS 
Uncore B-box O perfmon local box status MSR. Package 
Register Address: C22H, 3106 MSR_BO_PMON_BOX_OVF_CTRL 
Uncore B-box 0 perfmon local box overflow control MSR. Package 
Register Address: C30H, 3120 MSR_BO_PMON_EVNT_SELO 
Uncore B-box 0 perfmon event select MSR. Package 
Register Address: C31H, 3121 MSR_BO_PMON_CTRO 
Uncore B-box 0 perfmon counter MSR. Package 
Register Address: C32H, 3122 MSR_BO_PMON_EVNT_SEL1 
Uncore B-box 0 perfmon event select MSR. Package 
Register Address: C33H, 3123 MSR_BO_PMON_CTR1 
Uncore B-box O perfmon counter MSR. Package 
Register Address: C34H, 3124 MSR_BO_PMON_EVNT_SEL2 
Uncore B-box 0 perfmon event select MSR. Package 
Register Address: C35H, 3125 MSR_BO_PMON_CTR2 
Uncore B-box 0 perfmon counter MSR. Package 
Register Address: C36H, 3126 MSR_BO_PMON_EVNT_SEL3 
Uncore B-box 0 perfmon event select MSR. Package 
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Table 2-17. Additional MSRs in the Intel? Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: C37H, 3127 MSR_BO_PMON_CTR3 
Uncore B-box O perfmon counter MSR. Package 
Register Address: C40H, 3136 MSR_SO_PMON_BOX_CTRL 
Uncore S-box 0 perfmon local box control MSR. Package 
Register Address: C41H, 3137 MSR_SO_PMON_BOX_STATUS 
Uncore S-box 0 perfmon local box status MSR. Package 
Register Address: C42H, 3138 MSR_SO_PMON_BOX_OVF_CTRL 
Uncore S-box O perfmon local box overflow control MSR. Package 
Register Address: CSOH, 3152 MSR_SO_PMON_EVNT_SELO 
Uncore S-box O perfmon event select MSR. Package 
Register Address: C51H, 3153 MSR_SO_PMON_CTRO 
Uncore S-box 0 perfmon counter MSR. Package 
Register Address: C52H, 3154 MSR_SO_PMON_EVNT_SEL1 
Uncore S-box 0 perfmon event select MSR. Package 
Register Address: C53H, 3155 MSR_SO_PMON_CTR1 
Uncore S-box 0 perfmon counter MSR. Package 
Register Address: C54H, 3156 MSR_SO_PMON_EVNT_SEL2 
Uncore S-box O perfmon event select MSR. Package 
Register Address: C55H, 3157 MSR_SO_PMON_CTR2 
Uncore S-box 0 perfmon counter MSR. Package 
Register Address: C56H, 3158 MSR_SO_PMON_EVNT_SEL3 
Uncore S-box O perfmon event select MSR. Package 
Register Address: C57H, 3159 MSR_SO_PMON_CTR3 
Uncore S-box 0 perfmon counter MSR. Package 
Register Address: C60H, 3168 MSR_B1_PMON_BOX_CTRL 
Uncore B-box 1 perfmon local box control MSR. Package 
Register Address: C61H, 3169 MSR_B1_PMON_BOX_STATUS 
Uncore B-box 1 perfmon local box status MSR. Package 
Register Address: C62H, 3170 MSR_B1_PMON_BOX_OVF_CTRL 
Uncore B-box 1 perfmon local box overflow control MSR. Package 
Register Address: C70H, 3184 MSR_B1_PMON_EVNT_SELO 
Uncore B-box 1 perfmon event select MSR. Package 
Register Address: C71H, 3185 MSR_B1_PMON_CTRO 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C72H, 3186 MSR_B1_PMON_EVNT_SEL1 
Uncore B-box 1 perfmon event select MSR. Package 
Register Address: C73H, 3187 MSR_B1_PMON_CTR1 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C74H, 3188 MSR_B1_PMON_EVNT_SEL2 
Uncore B-box 1 perfmon event select MSR. Package 
Register Address: C75H, 3189 MSR_B1_PMON_CTR2 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C76H, 3190 MSR_B1_PMON_EVNT_SEL3 
Uncore B-box 1vperfmon event select MSR. Package 
Register Address: C77H, 3191 MSR_B1_PMON_CTR3 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C80H, 3120 MSR_W_PMON_BOX_CTRL 
Uncore W-box perfmon local box control MSR. Package 
Register Address: C81H, 3121 MSR_W_PMON_BOX_STATUS 
Uncore W-box perfmon local box status MSR. Package 
Register Address: C82H, 3122 MSR_W_PMON_BOX_OVF_CTRL 
Uncore W-box perfmon local box overflow control MSR. Package 
Register Address: C90H, 3136 MSR_W_PMON_EVNT_SELO 
Uncore W-box perfmon event select MSR. Package 
Register Address: C91H, 3137 MSR_W_PMON_CTRO 
Uncore W-box perfmon counter MSR. Package 
Register Address: C92H, 3138 MSR_W_PMON_EVNT_SEL1 
Uncore W-box perfmon event select MSR. Package 
Register Address: C93H, 3139 MSR_W_PMON_CTR1 
Uncore W-box perfmon counter MSR. Package 
Register Address: C94H, 3140 MSR_W_PMON_EVNT_SEL2 
Uncore W-box perfmon event select MSR. Package 
Register Address: C95H, 3141 MSR_W_PMON_CTR2 
Uncore W-box perfmon counter MSR. Package 
Register Address: C96H, 3142 MSR_W_PMON_EVNT_SEL3 
Uncore W-box perfmon event select MSR. Package 
Register Address: C97H, 3143 MSR_W_PMON_CTR3 
Uncore W-box perfmon counter MSR. Package 
Register Address: CAQH, 3232 MSR_MO_PMON_BOX_CTRL 
Uncore M-box 0 perfmon local box control MSR. Package 
Register Address: CA1H, 3233 MSR_MO_PMON_BOX_STATUS 
Uncore M-box 0 perfmon local box status MSR. Package 
Register Address: CA2H, 3234 MSR_MO_PMON_BOX_OVF_CTRL 
Uncore M-box 0 perfmon local box overflow control MSR. Package 
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Table 2-17. Additional MSRs in the Intel? Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: CA4H, 3236 MSR_MO_PMON_TIMESTAMP 
Uncore M-box 0 perfmon time stamp unit select MSR. Package 
Register Address: CA5H, 3237 MSR_MO_PMON_DSP 
Uncore M-box O perfmon DSP unit select MSR. Package 
Register Address: CA6H, 3238 MSR_MO_PMON_ISS 
Uncore M-box 0 perfmon ISS unit select MSR. Package 
Register Address: CA7H, 3239 MSR_MO_PMON_MAP 
Uncore M-box O perfmon MAP unit select MSR. Package 
Register Address: CA8H, 3240 MSR_MO_PMON_MSC_THR 
Uncore M-box O perfmon MIC THR select MSR. Package 
Register Address: CASH, 3241 MSR_MO_PMON_PGT 
Uncore M-box O perfmon PGT unit select MSR. Package 
Register Address: CAAH, 3242 MSR_MO_PMON_PLD 
Uncore M-box 0 perfmon PLD unit select MSR. Package 
Register Address: CABH, 3243 MSR_MO_PMON_ZDP 
Uncore M-box O perfmon ZDP unit select MSR. Package 
Register Address: CBOH, 3248 MSR_MO_PMON_EVNT_SELO 
Uncore M-box O perfmon event select MSR. Package 
Register Address: CB1H, 3249 MSR_MO_PMON_CTRO 
Uncore M-box O perfmon counter MSR. Package 
Register Address: CB2H, 3250 MSR_MO_PMON_EVNT_SEL1 
Uncore M-box O perfmon event select MSR. Package 
Register Address: CB3H, 3251 MSR_MO_PMON_CTR1 
Uncore M-box 0 perfmon counter MSR. Package 
Register Address: CB4H, 3252 MSR_MO_PMON_EVNT_SEL2 
Uncore M-box O perfmon event select MSR. Package 
Register Address: CB5H, 3253 MSR_MO_PMON_CTR2 
Uncore M-box 0 perfmon counter MSR. Package 
Register Address: CB6H, 3254 MSR_MO_PMON_EVNT_SEL3 
Uncore M-box O perfmon event select MSR. Package 
Register Address: CB7H, 3255 MSR_MO_PMON_CTR3 
Uncore M-box 0 perfmon counter MSR. Package 
Register Address: CB8H, 3256 MSR_MO_PMON_EVNT_SEL4 
Uncore M-box 0 perfmon event select MSR. Package 
Register Address: CB9H, 3257 MSR_MO_PMON_CTR4 
Uncore M-box 0 perfmon counter MSR. Package 
Register Address: CBAH, 3258 MSR_MO_PMON_EVNT_SEL5 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Uncore M-box O perfmon event select MSR. Package 
Register Address: CBBH, 3259 MSR_MO_PMON_CTR5 
Uncore M-box O perfmon counter MSR. Package 
Register Address: CCOH, 3264 MSR_S1_PMON_BOX_CTRL 
Uncore S-box 1 perfmon local box control MSR. Package 
Register Address: CC1H, 3265 MSR_S1_PMON_BOX_STATUS 
Uncore S-box 1 perfmon local box status MSR. Package 
Register Address: CC2H, 3266 MSR_S1_PMON_BOX_OVF_CTRL 
Uncore S-box 1 perfmon local box overflow control MSR. Package 
Register Address: CDOH, 3280 MSR_S1_PMON_EVNT_SELO 
Uncore S-box 1 perfmon event select MSR. Package 
Register Address: CD1H, 3281 MSR_S1_PMON_CTRO 
Uncore S-box 1 perfmon counter MSR. Package 
Register Address: CD2H, 3282 MSR_S1_PMON_EVNT_SEL1 
Uncore S-box 1 perfmon event select MSR. Package 
Register Address: CD3H, 3283 MSR_S1_PMON_CTR1 
Uncore S-box 1 perfmon counter MSR. Package 
Register Address: CD4H, 3284 MSR_S1_PMON_EVNT_SEL2 
Uncore S-box 1 perfmon event select MSR. Package 
Register Address: CD5H, 3285 MSR_S1_PMON_CTR2 
Uncore S-box 1 perfmon counter MSR. Package 
Register Address: CD6H, 3286 MSR_S1_PMON_EVNT_SEL3 
Uncore S-box 1 perfmon event select MSR. Package 
Register Address: CD7H, 3287 MSR_S1_PMON_CTR3 
Uncore S-box 1 perfmon counter MSR. Package 
Register Address: CEQH, 3296 MSR_M1_PMON_BOX_CTRL 
Uncore M-box 1 perfmon local box control MSR. Package 
Register Address: CE1H, 3297 MSR_M1_PMON_BOX_STATUS 
Uncore M-box 1 perfmon local box status MSR. Package 
Register Address: CE2H, 3298 MSR_M1_PMON_BOX_OVF_CTRL 
Uncore M-box 1 perfmon local box overflow control MSR. Package 
Register Address: CE4H, 3300 MSR_M1_PMON_TIMESTAMP 
Uncore M-box 1 perfmon time stamp unit select MSR. Package 
Register Address: CE5H, 3301 MSR_M1_PMON_DSP 
Uncore M-box 1 perfmon DSP unit select MSR. Package 
Register Address: CE6H, 3302 MSR_M1_PMON_ISS 
Uncore M-box 1 perfmon ISS unit select MSR. Package 
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Register Address: CE7H, 3303 MSR_M1_PMON_MAP 
Uncore M-box 1 perfmon MAP unit select MSR. Package 
Register Address: CE8H, 3304 MSR_M1_PMON_MSC_THR 
Uncore M-box 1 perfmon MIC THR select MSR. Package 
Register Address: CE9SH, 3305 MSR_M1_PMON_PGT 
Uncore M-box 1 perfmon PGT unit select MSR. Package 
Register Address: CEAH, 3306 MSR_M1_PMON_PLD 
Uncore M-box 1 perfmon PLD unit select MSR. Package 
Register Address: CEBH, 3307 MSR_M1_PMON_ZDP 
Uncore M-box 1 perfmon ZDP unit select MSR. Package 
Register Address: CFOH, 3312 MSR_M1_PMON_EVNT_SELO 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CF1H, 3313 MSR_M1_PMON_CTRO 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: CF2H, 3314 MSR_M1_PMON_EVNT_SEL1 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CF3H, 3315 MSR_M1_PMON_CTR1 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: CF4H, 3316 MSR_M1_PMON_EVNT_SEL2 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CF5H, 3317 MSR_M1_PMON_CTR2 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: CF6H, 3318 MSR_M1_PMON_EVNT_SEL3 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CF7H, 3319 MSR_M1_PMON_CTR3 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: CF8H, 3320 MSR_M1_PMON_EVNT_SEL4 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CF9H, 3321 MSR_M1_PMON_CTR4 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: CFAH, 3322 MSR_M1_PMON_EVNT_SEL5 
Uncore M-box 1 perfmon event select MSR. Package 
Register Address: CFBH, 3323 MSR_M1_PMON_CTR5 
Uncore M-box 1 perfmon counter MSR. Package 
Register Address: DOOH, 3328 MSR_CO_PMON_BOX_CTRL 
Uncore C-box 0 perfmon local box control MSR. Package 
Register Address: DO1H, 3329 MSR_CO_PMON_BOX_STATUS 
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Uncore C-box O perfmon local box status MSR. Package 
Register Address: DOZH, 3330 MSR_CO_PMON_BOX_OVF_CTRL 
Uncore C-box O perfmon local box overflow control MSR. Package 
Register Address: D10H, 3344 MSR_CO_PMON_EVNT_SELO 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D11H, 3345 MSR_CO_PMON_CTRO 
Uncore C-box O perfmon counter MSR. Package 
Register Address: D12H, 3346 MSR_CO_PMON_EVNT_SEL1 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D13H, 3347 MSR_CO_PMON_CTR1 
Uncore C-box O perfmon counter MSR. Package 
Register Address: D14H, 3348 MSR_CO_PMON_EVNT_SEL2 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D15H, 3349 MSR_CO_PMON_CTR2 
Uncore C-box O perfmon counter MSR. Package 
Register Address: D16H, 3350 MSR_CO_PMON_EVNT_SEL3 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D1 7H, 3351 MSR_CO_PMON_CTR3 
Uncore C-box O perfmon counter MSR. Package 
Register Address: D18H, 3352 MSR_CO_PMON_EVNT_SEL4 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D19H, 3353 MSR_CO_PMON_CTR4 
Uncore C-box O perfmon counter MSR. Package 
Register Address: D1AH, 3354 MSR_CO_PMON_EVNT_SEL5 
Uncore C-box O perfmon event select MSR. Package 
Register Address: D1BH, 3355 MSR_CO_PMON_CTR5 
Uncore C-box 0 perfmon counter MSR. Package 
Register Address: D20H, 3360 MSR_C4_PMON_BOX_CTRL 
Uncore C-box 4 perfmon local box control MSR. Package 
Register Address: D21H, 3361 MSR_C4_PMON_BOX_STATUS 
Uncore C-box 4 perfmon local box status MSR. Package 
Register Address: D22H, 3362 MSR_C4_PMON_BOX_OVF_CTRL 
Uncore C-box 4 perfmon local box overflow control MSR. Package 
Register Address: D30H, 3376 MSR_C4_PMON_EVNT_SELO 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D31H, 3377 MSR_C4_PMON_CTRO 
Uncore C-box 4 perfmon counter MSR. Package 
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Register Address: D32H, 3378 MSR_C4_PMON_EVNT_SEL1 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D33H, 3379 MSR_C4_PMON_CTR1 
Uncore C-box 4 perfmon counter MSR. Package 
Register Address: D34H, 3380 MSR_C4_PMON_EVNT_SEL2 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D35H, 3381 MSR_C4_PMON_CTR2 
Uncore C-box 4 perfmon counter MSR. Package 
Register Address: D36H, 3382 MSR_C4_PMON_EVNT_SEL3 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D37H, 3383 MSR_C4_PMON_CTR3 
Uncore C-box 4 perfmon counter MSR. Package 
Register Address: D38H, 3384 MSR_C4_PMON_EVNT_SEL4 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D39H, 3385 MSR_C4_PMON_CTR4 
Uncore C-box 4 perfmon counter MSR. Package 
Register Address: D3AH, 3386 MSR_C4_PMON_EVNT_SEL5 
Uncore C-box 4 perfmon event select MSR. Package 
Register Address: D3BH, 3387 MSR_C4_PMON_CTR5 
Uncore C-box 4 perfmon counter MSR. Package 
Register Address: D40H, 3392 MSR_C2_PMON_BOX_CTRL 
Uncore C-box 2 perfmon local box control MSR. Package 
Register Address: D41H, 3393 MSR_C2_PMON_BOX_STATUS 
Uncore C-box 2 perfmon local box status MSR. Package 
Register Address: D42H, 3394 MSR_C2_PMON_BOX_OVF_CTRL 
Uncore C-box 2 perfmon local box overflow control MSR. Package 
Register Address: D50H, 3408 MSR_C2_PMON_EVNT_SELO 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: D51H, 3409 MSR_C2_PMON_CTRO 
Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D52H, 3410 MSR_C2_PMON_EVNT_SEL1 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: D53H, 3411 MSR_C2_PMON_CTR1 
Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D54H, 3412 MSR_C2_PMON_EVNT_SEL2 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: D55H, 3413 MSR_C2_PMON_CTR2 
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Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D56H, 3414 MSR_C2_PMON_EVNT_SEL3 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: D57H, 3415 MSR_C2_PMON_CTR3 
Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D58H, 3416 MSR_C2_PMON_EVNT_SEL4 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: D59H, 3417 MSR_C2_PMON_CTR4 
Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D5AH, 3418 MSR_C2_PMON_EVNT_SEL5 
Uncore C-box 2 perfmon event select MSR. Package 
Register Address: DSBH, 3419 MSR_C2_PMON_CTR5 
Uncore C-box 2 perfmon counter MSR. Package 
Register Address: D60H, 3424 MSR_C6_PMON_BOX_CTRL 
Uncore C-box 6 perfmon local box control MSR. Package 
Register Address: D61H, 3425 MSR_C6_PMON_BOX_STATUS 
Uncore C-box 6 perfmon local box status MSR. Package 
Register Address: D62H, 3426 MSR_C6_PMON_BOX_OVF_CTRL 
Uncore C-box 6 perfmon local box overflow control MSR. Package 
Register Address: D70H, 3440 MSR_C6_PMON_EVNT_SELO 
Uncore C-box 6 perfmon event select MSR. Package 
Register Address: D71H, 3441 MSR_C6_PMON_CTRO 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D72H, 3442 MSR_C6_PMON_EVNT_SEL1 
Uncore C-box 6 perfmon event select MSR. Package 
Register Address: D73H, 3443 MSR_C6_PMON_CTR1 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D74H, 3444 MSR_C6_PMON_EVNT_SEL2 
Uncore C-box 6 perfmon event select MSR. Package 
Register Address: D75H, 3445 MSR_C6_PMON_CTR2 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D76H, 3446 MSR_C6_PMON_EVNT_SEL3 
Uncore C-box 6 perfmon event select MSR. Package 
Register Address: D77H, 3447 MSR_C6_PMON_CTR3 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D78H, 3448 MSR_C6_PMON_EVNT_SEL4 
Uncore C-box 6 perfmon event select MSR. Package 
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Register Address: D79H, 3449 MSR_C6_PMON_CTR4 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D7AH, 3450 MSR_C6_PMON_EVNT_SEL5 
Uncore C-box 6 perfmon event select MSR. Package 
Register Address: D7BH, 3451 MSR_C6_PMON_CTR5 
Uncore C-box 6 perfmon counter MSR. Package 
Register Address: D80H, 3456 MSR_C1_PMON_BOX_CTRL 
Uncore C-box 1 perfmon local box control MSR. Package 
Register Address: D81H, 3457 MSR_C1_PMON_BOX_STATUS 
Uncore C-box 1 perfmon local box status MSR. Package 
Register Address: D82H, 3458 MSR_C1_PMON_BOX_OVF_CTRL 
Uncore C-box 1 perfmon local box overflow control MSR. Package 
Register Address: D9OH, 3472 MSR_C1_PMON_EVNT_SELO 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D91H, 3473 MSR_C1_PMON_CTRO 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: D92H, 3474 MSR_C1_PMON_EVNT_SEL1 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D93H, 3475 MSR_C1_PMON_CTR1 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: D94H, 3476 MSR_C1_PMON_EVNT_SEL2 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D95H, 3477 MSR_C1_PMON_CTR2 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: D9GH, 3478 MSR_C1_PMON_EVNT_SEL3 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D97H, 3479 MSR_C1_PMON_CTR3 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: D98H, 3480 MSR_C1_PMON_EVNT_SEL4 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D99H, 3481 MSR_C1_PMON_CTR4 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: D9AH, 3482 MSR_C1_PMON_EVNT_SEL5 
Uncore C-box 1 perfmon event select MSR. Package 
Register Address: D9BH, 3483 MSR_C1_PMON_CTR5 
Uncore C-box 1 perfmon counter MSR. Package 
Register Address: DAOH, 3488 MSR_C5_PMON_BOX_CTRL 
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Uncore C-box 5 perfmon local box control MSR. Package 
Register Address: DA1H, 3489 MSR_C5_PMON_BOX_STATUS 
Uncore C-box 5 perfmon local box status MSR. Package 
Register Address: DA2H, 3490 MSR_C5_PMON_BOX_OVF_CTRL 
Uncore C-box 5 perfmon local box overflow control MSR. Package 
Register Address: DBOH, 3504 MSR_C5_PMON_EVNT_SELO 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DB1H, 3505 MSR_C5_PMON_CTRO 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DB2H, 3506 MSR_C5_PMON_EVNT_SEL1 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DB3H, 3507 MSR_C5_PMON_CTR1 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DB4H, 3508 MSR_C5_PMON_EVNT_SEL2 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DB5H, 3509 MSR_C5_PMON_CTR2 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DB6H, 3510 MSR_C5_PMON_EVNT_SEL3 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DB7H, 3511 MSR_C5_PMON_CTR3 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DB8H, 3512 MSR_C5_PMON_EVNT_SEL4 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DBSH, 3513 MSR_C5_PMON_CTR4 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DBAH, 3514 MSR_C5_PMON_EVNT_SEL5 
Uncore C-box 5 perfmon event select MSR. Package 
Register Address: DBBH, 3515 MSR_C5_PMON_CTR5 
Uncore C-box 5 perfmon counter MSR. Package 
Register Address: DCOH, 3520 MSR_C3_PMON_BOX_CTRL 
Uncore C-box 3 perfmon local box control MSR. Package 
Register Address: DC1H, 3521 MSR_C3_PMON_BOX_STATUS 
Uncore C-box 3 perfmon local box status MSR. Package 
Register Address: DC2H, 3522 MSR_C3_PMON_BOX_OVF_CTRL 
Uncore C-box 3 perfmon local box overflow control MSR. Package 
Register Address: DDOH, 3536 MSR_C3_PMON_EVNT_SELO 
Uncore C-box 3 perfmon event select MSR. Package 
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Register Address: DD1H, 3537 MSR_C3_PMON_CTRO 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DD2H, 3538 MSR_C3_PMON_EVNT_SEL1 
Uncore C-box 3 perfmon event select MSR. Package 
Register Address: DD3H, 3539 MSR_C3_PMON_CTR1 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DD4H, 3540 MSR_C3_PMON_EVNT_SEL2 
Uncore C-box 3 perfmon event select MSR. Package 
Register Address: DD5H, 3541 MSR_C3_PMON_CTR2 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DD6H, 3542 MSR_C3_PMON_EVNT_SEL3 
Uncore C-box 3 perfmon event select MSR. Package 
Register Address: DD7H, 3543 MSR_C3_PMON_CTR3 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DD8H, 3544 MSR_C3_PMON_EVNT_SEL4 
Uncore C-box 3 perfmon event select MSR. Package 
Register Address: DDSH, 3545 MSR_C3_PMON_CTR4 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DDAH, 3546 MSR_C3_PMON_EVNT_SEL5 
Uncore C-box 3 perfmon event select MSR. Package 
Register Address: DDBH, 3547 MSR_C3_PMON_CTR5 
Uncore C-box 3 perfmon counter MSR. Package 
Register Address: DEOH, 3552 MSR_C7_PMON_BOX_CTRL 
Uncore C-box 7 perfmon local box control MSR. Package 
Register Address: DE1H, 3553 MSR_C7_PMON_BOX_STATUS 
Uncore C-box 7 perfmon local box status MSR. Package 
Register Address: DE2H, 3554 MSR_C7_PMON_BOX_OVF_CTRL 
Uncore C-box 7 perfmon local box overflow control MSR. Package 
Register Address: DFOH, 3568 MSR_C7_PMON_EVNT_SELO 
Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DF1H, 3569 MSR_C7_PMON_CTRO 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: DF2H, 3570 MSR_C7_PMON_EVNT_SEL1 
Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DF3H, 3571 MSR_C7_PMON_CTR1 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: DF4H, 3572 MSR_C7_PMON_EVNT_SEL2 
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Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DF5H, 3573 MSR_C7_PMON_CTR2 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: DF6H, 3574 MSR_C7_PMON_EVNT_SEL3 
Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DF7H, 3575 MSR_C7_PMON_CTR3 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: DF8H, 3576 MSR_C7_PMON_EVNT_SEL4 
Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DF9H, 3577 MSR_C7_PMON_CTR4 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: DFAH, 3578 MSR_C7_PMON_EVNT_SEL5 
Uncore C-box 7 perfmon event select MSR. Package 
Register Address: DFBH, 3579 MSR_C7_PMON_CTR5 
Uncore C-box 7 perfmon counter MSR. Package 
Register Address: EQOH, 3584 MSR_RO_PMON_BOX_CTRL 
Uncore R-box 0 perfmon local box control MSR. Package 
Register Address: E01H, 3585 MSR_RO_PMON_BOX_STATUS 
Uncore R-box 0 perfmon local box status MSR. Package 
Register Address: E02H, 3586 MSR_RO_PMON_BOX_OVF_CTRL 
Uncore R-box O perfmon local box overflow control MSR. Package 
Register Address: E04H, 3588 MSR_RO_PMON_IPERFO_PO 
Uncore R-box O perfmon IPERFO unit Port O select MSR. Package 
Register Address: E05H, 3589 MSR_RO_PMON_IPERFO_P1 
Uncore R-box O perfmon IPERFO unit Port 1 select MSR. Package 
Register Address: EO6H, 3590 MSR_RO_PMON_IPERFO_P2 
Uncore R-box O perfmon IPERFO unit Port 2 select MSR. Package 
Register Address: E07H, 3591 MSR_RO_PMON_IPERFO_P3 
Uncore R-box 0 perfmon IPERFO unit Port 3 select MSR. Package 
Register Address: E08H, 3592 MSR_RO_PMON_IPERFO_P4 
Uncore R-box 0 perfmon IPERFO unit Port 4 select MSR. Package 
Register Address: EO9H, 3593 MSR_RO_PMON_IPERFO_P5 
Uncore R-box 0 perfmon IPERFO unit Port 5 select MSR. Package 
Register Address: EOAH, 3594 MSR_RO_PMON_IPERFO_P6 
Uncore R-box O perfmon IPERFO unit Port 6 select MSR. Package 
Register Address: EOBH, 3595 MSR_RO_PMON_IPERFO_P7 
Uncore R-box O perfmon IPERFO unit Port 7 select MSR. Package 
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Register Address: EOCH, 3596 MSR_RO_PMON_QLX_PO 
Uncore R-box 0 perfmon QLX unit Port 0 select MSR. Package 
Register Address: EODH, 3597 MSR_RO_PMON_QLX_P1 
Uncore R-box O perfmon QLX unit Port 1 select MSR. Package 
Register Address: EQEH, 3598 MSR_RO_PMON_QLX_P2 
Uncore R-box 0 perfmon QLX unit Port 2 select MSR. Package 
Register Address: EOFH, 3599 MSR_RO_PMON_QLX_P3 
Uncore R-box 0 perfmon QLX unit Port 3 select MSR. Package 
Register Address: €10H, 3600 MSR_RO_PMON_EVNT_SELO 
Uncore R-box O perfmon event select MSR. Package 
Register Address: €11H, 3601 MSR_RO_PMON_CTRO 
Uncore R-box O perfmon counter MSR. Package 
Register Address: €12H, 3602 MSR_RO_PMON_EVNT_SEL1 
Uncore R-box O perfmon event select MSR. Package 
Register Address: €13H, 3603 MSR_RO_PMON_CTR1 
Uncore R-box O perfmon counter MSR. Package 
Register Address: 14H, 3604 MSR_RO_PMON_EVNT_SEL2 
Uncore R-box 0 perfmon event select MSR. Package 
Register Address: €15H, 3605 MSR_RO_PMON_CTR2 
Uncore R-box O perfmon counter MSR. Package 
Register Address: €16H, 3606 MSR_RO_PMON_EVNT_SEL3 
Uncore R-box O perfmon event select MSR. Package 
Register Address: 17H, 3607 MSR_RO_PMON_CTR3 
Uncore R-box O perfmon counter MSR. Package 
Register Address: €18H, 3608 MSR_RO_PMON_EVNT_SEL4 
Uncore R-box O perfmon event select MSR. Package 
Register Address: 19H, 3609 MSR_RO_PMON_CTR4 
Uncore R-box O perfmon counter MSR. Package 
Register Address: €1AH, 3610 MSR_RO_PMON_EVNT_SEL5 
Uncore R-box O perfmon event select MSR. Package 
Register Address: €1BH, 3611 MSR_RO_PMON_CTR5 
Uncore R-box O perfmon counter MSR. Package 
Register Address: €1CH, 3612 MSR_RO_PMON_EVNT_SEL6 
Uncore R-box O perfmon event select MSR. Package 
Register Address: €1DH, 3613 MSR_RO_PMON_CTR6 
Uncore R-box O perfmon counter MSR. Package 
Register Address: E1€H, 3614 MSR_RO_PMON_EVNT_SEL7 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 
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Register Information / Bit Fields Bit Description Scope 
Uncore R-box O perfmon event select MSR. Package 
Register Address: €1FH, 3615 MSR_RO_PMON_CTR7 
Uncore R-box O perfmon counter MSR. Package 
Register Address: E20H, 3616 MSR_R1_PMON_BOX_CTRL 
Uncore R-box 1 perfmon local box control MSR. Package 
Register Address: 21H, 3617 MSR_R1_PMON_BOX_STATUS 
Uncore R-box 1 perfmon local box status MSR. Package 
Register Address: E22H, 3618 MSR_R1_PMON_BOX_OVF_CTRL 
Uncore R-box 1 perfmon local box overflow control MSR. Package 
Register Address: E24H, 3620 MSR_R1_PMON_IPERF1_P8 
Uncore R-box 1 perfmon IPERF1 unit Port 8 select MSR. Package 
Register Address: E25H, 3621 MSR_R1_PMON_IPERF1_P9 
Uncore R-box 1 perfmon IPERF1 unit Port 9 select MSR. Package 
Register Address: E26H, 3622 MSR_R1_PMON_IPERF1_P10 
Uncore R-box 1 perfmon IPERF1 unit Port 10 select MSR. Package 
Register Address: E27H, 3623 MSR_R1_PMON_IPERF1_P11 
Uncore R-box 1 perfmon IPERF1 unit Port 11 select MSR. Package 
Register Address: E28H, 3624 MSR_R1_PMON_IPERF1_P12 
Uncore R-box 1 perfmon IPERF1 unit Port 12 select MSR. Package 
Register Address: E29H, 3625 MSR_R1_PMON_IPERF1_P13 
Uncore R-box 1 perfmon IPERF1 unit Port 13 select MSR. Package 
Register Address: E2AH, 3626 MSR_R1_PMON_IPERF1_P14 
Uncore R-box 1 perfmon IPERF1 unit Port 14 select MSR. Package 
Register Address: E2BH, 3627 MSR_R1_PMON_IPERF1_P15 
Uncore R-box 1 perfmon IPERF1 unit Port 15 select MSR. Package 
Register Address: E2CH, 3628 MSR_R1_PMON_QLX_P4 
Uncore R-box 1 perfmon QLX unit Port 4 select MSR. Package 
Register Address: E2DH, 3629 MSR_R1_PMON_QLX_P5 
Uncore R-box 1 perfmon QLX unit Port 5 select MSR. Package 
Register Address: E2EH, 3630 MSR_R1_PMON_QLX_P6 
Uncore R-box 1 perfmon QLX unit Port 6 select MSR. Package 
Register Address: E2FH, 3631 MSR_R1_PMON_QLX_P7 
Uncore R-box 1 perfmon QLX unit Port 7 select MSR. Package 
Register Address: E30H, 3632 MSR_R1_PMON_EVNT_SEL8 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E31H, 3633 MSR_R1_PMON_CTR8 
Uncore R-box 1 perfmon counter MSR. Package 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-17. Additional MSRs in the Intel? Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 32H, 3634 MSR_R1_PMON_EVNT_SEL9 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: €33H, 3635 MSR_R1_PMON_CTR9 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: E34H, 3636 MSR_R1_PMON_EVNT_SEL10 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E35H, 3637 MSR_R1_PMON_CTR10 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: E36H, 3638 MSR_R1_PMON_EVNT_SEL11 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: 37H, 3639 MSR_R1_PMON_CTR11 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: 38H, 3640 MSR_R1_PMON_EVNT_SEL12 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E39H, 3641 MSR_R1_PMON_CTR12 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: E3AH, 3642 MSR_R1_PMON_EVNT_SEL13 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E3BH, 3643 MSR_R1_PMON_CTR13 
Uncore R-box 1perfmon counter MSR. Package 
Register Address: E3CH, 3644 MSR_R1_PMON_EVNT_SEL14 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E3DH, 3645 MSR_R1_PMON_CTR14 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: E3EH, 3646 MSR_R1_PMON_EVNT_SEL15 
Uncore R-box 1 perfmon event select MSR. Package 
Register Address: E3FH, 3647 MSR_R1_PMON_CTR15 
Uncore R-box 1 perfmon counter MSR. Package 
Register Address: 45H, 3653 MSR_BO_PMON_MATCH 
Uncore B-box O perfmon local box match MSR. Package 
Register Address: E46H, 3654 MSR_BO_PMON_MASK 
Uncore B-box 0 perfmon local box mask MSR. Package 
Register Address: E49H, 3657 MSR_SO_PMON_MATCH 
Uncore S-box O perfmon local box match MSR. Package 
Register Address: E4AH, 3658 MSR_SO_PMON_MASK 
Uncore S-box 0 perfmon local box mask MSR. Package 
Register Address: E4DH, 3661 MSR_B1_PMON_MATCH 
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Table 2-17. Additional MSRs in the Intel® Xeon® Processor 7500 Series (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore B-box 1 perfmon local box match MSR. Package 
Register Address: E4EH, 3662 MSR_B1_PMON_MASK 
Uncore B-box 1 perfmon local box mask MSR. Package 
Register Address: E54H, 3668 MSR_MO_PMON_MM_CONFIG 
Uncore M-box 0 perfmon local box address match/mask config MSR. Package 
Register Address: 55H, 3669 MSR_MO_PMON_ADDR_MATCH 
Uncore M-box 0 perfmon local box address match MSR. Package 
Register Address: E56H, 3670 MSR_MO_PMON_ADDR_MASK 
Uncore M-box 0 perfmon local box address mask MSR. Package 
Register Address: E59H, 3673 MSR_S1_PMON_MATCH 
Uncore S-box 1 perfmon local box match MSR. Package 
Register Address: E5AH, 3674 MSR_S1_PMON_MASK 
Uncore S-box 1 perfmon local box mask MSR. Package 
Register Address: E5CH, 3676 MSR_M1_PMON_MM_CONFIG 
Uncore M-box 1 perfmon local box address match/mask config MSR. Package 
Register Address: E5DH, 3677 MSR_M1_PMON_ADDR_MATCH 
Uncore M-box 1 perfmon local box address match MSR. Package 
Register Address: E5EH, 3678 MSR_M1_PMON_ADDR_MASK 
Uncore M-box 1 perfmon local box address mask MSR. Package 
Register Address: 3B5H, 965 MSR_UNCORE_PMC5 
See Section 20.3.1.2.2, “Uncore Performance Event Configuration Facility.” Package 


29 


MSRS IN THE INTEL® XEON® PROCESSOR 5600 SERIES BASED ON 


WESTMERE MICROARCHITECTURE 


The Intel® Xeon® Processor 5600 Series is based on Westmere microarchitecture and supports the MSR interfaces 
listed in Table 2-15, Table 2-16, plus additional MSRs listed in Table 2-18. These MSRs apply to the Intel Core i7, i5, 
and i3 processor family with a CPUID Signature DisplayFamily_DisplayModel value of 06_25H or 06_2CH; see Table 
2-1. 


Table 2-18. Additional MSRs Supported by Intel® Processors Based on Westmere Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 13CH, 316 MSR_FEATURE_CONFIG 
AES Configuration (RW-L) Core 
Privileged post-BIOS agent must provide a #GP handler to handle unsuccessful read of this MSR. 
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Table 2-18. Additional MSRs Supported by Intel® Processors Based on Westmere Microarchitecture (Contd.) 
Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


1:0 AES Configuration (RW-L) 


Upon a successful read of this MSR, the configuration of AES instruction 
set availability is as follows: 


11b: AES instructions are not available until next RESET. 
Otherwise, AES instructions are available. 


Note, AES instruction set is not available if read is unsuccessful. If the 
configuration is not 01b, AES instructions can be mis-configured if a 
privileged agent unintentionally writes 11b. 


63:2 Reserved. 

Register Address: 1A7H, 423 MSR_OFFCORE_RSP_1 

Offcore Response Event Select Register (R/W) Thread 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 

Maximum Ratio Limit of Turbo Mode Package 


R/O if MSR_PLATFORM_INFO.[28] = 0. 
R/W if MSR_PLATFORM_INFO,[28] = 1. 


7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 

39:32 Maximum Ratio Limit for 5C Package 
Maximum turbo ratio limit of 5 core active. 

47:40 Maximum Ratio Limit for 6C Package 
Maximum turbo ratio limit of 6 core active. 

63:48 Reserved. 

Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 

See Table 2-2. Package 


2.10 MSRSIN THE INTEL® XEON® PROCESSOR E7 FAMILY BASED ON WESTMERE 
MICROARCHITECTURE 


The Intel® Xeon® Processor E7 Family is based on the Westmere microarchitecture and supports the MSR inter- 
faces listed in Table 2-15 (except MSR address 1ADH), Table 2-16, plus additional MSRs listed in Table 2-19. These 
processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_2FH. 
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Table 2-19. Additional MSRs Supported by the Intel® Xeon® Processor E7 Family 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 13CH, 316 MSR_FEATURE_CONFIG 
AES Configuration (RW-L) Core 
Privileged post-BIOS agent must provide a #GP handler to handle unsuccessful read of this MSR. 
1:0 AES Configuration (RW-L) 
Upon a successful read of this MSR, the configuration of AES instruction set 
availability is as follows: 
11b: AES instructions are not available until next RESET. 
Otherwise, AES instructions are available. 
Note, AES instruction set is not available if read is unsuccessful. If the 
configuration is not 01b, AES instructions can be mis-configured if a 
privileged agent unintentionally writes 11b. 
63:2 Reserved. 
Register Address: 1A7H, 423 MSR_OFFCORE_RSP_1 
Offcore Response Event Select Register (R/W) Thread 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Reserved. Attempt to read/write will cause #UD. Package 
Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 
See Table 2-2. Package 
Register Address: F40H, 3904 MSR_C8_PMON_BOX_CTRL 
Uncore C-box 8 perfmon local box control MSR. Package 
Register Address: F41H, 3905 MSR_C8_PMON_BOX_STATUS 
Uncore C-box 8 perfmon local box status MSR. Package 
Register Address: F42H, 3906 MSR_C8_PMON_BOX_OVF_CTRL 
Uncore C-box 8 perfmon local box overflow control MSR. Package 
Register Address: F50H, 3920 MSR_C8_PMON_EVNT_SELO 
Uncore C-box 8 perfmon event select MSR. Package 
Register Address: F51H, 3921 MSR_C8_PMON_CTRO 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: F52H, 3922 MSR_C8_PMON_EVNT_SEL1 
Uncore C-box 8 perfmon event select MSR. Package 
Register Address: F53H, 3923 MSR_C8_PMON_CTR1 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: F54H, 3924 MSR_C8_PMON_EVNT_SEL2 
Uncore C-box 8 perfmon event select MSR. Package 
Register Address: F55H, 3925 MSR_C8_PMON_CTR2 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: F56H, 3926 MSR_C8_PMON_EVNT_SEL3 
Uncore C-box 8 perfmon event select MSR. Package 
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Table 2-19. Additional MSRs Supported by the Intel® Xeon® Processor E7 Family (Contd.) 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: F57H, 3927 MSR_C8_PMON_CTR3 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: F58H, 3928 MSR_C8_PMON_EVNT_SEL4 
Uncore C-box 8 perfmon event select MSR. Package 
Register Address: F59H, 3929 MSR_C8_PMON_CTR4 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: FSAH, 3930 MSR_C8_PMON_EVNT_SEL5 
Uncore C-box 8 perfmon event select MSR. Package 
Register Address: FSBH, 3931 MSR_C8_PMON_CTR5 
Uncore C-box 8 perfmon counter MSR. Package 
Register Address: FCOH, 4032 MSR_C9_PMON_BOX_CTRL 
Uncore C-box 9 perfmon local box control MSR. Package 
Register Address: FC1H, 4033 MSR_C9_PMON_BOX_STATUS 
Uncore C-box 9 perfmon local box status MSR. Package 
Register Address: FC2H, 4034 MSR_C9_PMON_BOX_OVF_CTRL 
Uncore C-box 9 perfmon local box overflow control MSR. Package 
Register Address: FDOH, 4048 MSR_C9_PMON_EVNT_SELO 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FD1H, 4049 MSR_C9_PMON_CTRO 
Uncore C-box 9 perfmon counter MSR. Package 
Register Address: FD2H, 4050 MSR_C9_PMON_EVNT_SEL1 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FD3H, 4051 MSR_C9_PMON_CTR1 
Uncore C-box 9 perfmon counter MSR. Package 
Register Address: FD4H, 4052 MSR_C9_PMON_EVNT_SEL2 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FD5H, 4053 MSR_C9_PMON_CTR2 
Uncore C-box 9 perfmon counter MSR. Package 
Register Address: FD6H, 4054 MSR_C9_PMON_EVNT_SEL3 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FD7H, 4055 MSR_C9_PMON_CTR3 
Uncore C-box 9 perfmon counter MSR. Package 
Register Address: FD8H, 4056 MSR_C9_PMON_EVNT_SEL4 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FDSH, 4057 MSR_C9_PMON_CTR4 
Uncore C-box 9 perfmon counter MSR. Package 
Register Address: FDAH, 4058 MSR_C9_PMON_EVNT_SEL5 
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Table 2-19. Additional MSRs Supported by the Intel® Xeon® Processor E7 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-box 9 perfmon event select MSR. Package 
Register Address: FDBH, 4059 MSR_C9_PMON_CTR5 
Uncore C-box 9 perfmon counter MSR. Package 


2.11 MSRSIN THE INTEL® PROCESSOR FAMILY BASED ON SANDY BRIDGE 
MICROARCHITECTURE 


Table 2-20 lists model-specific registers (MSRs) that are common to the Intel® processor family based on Sandy 
Bridge microarchitecture. These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_2AH 
or 06_2DH; see Table 2-1. Additional MSRs specific to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_2AH are listed in Table 2-21. 


Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: OH, O IA32_P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors.” Thread 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors.” Thread 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Thread 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and see Table 2-2. Thread 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Package 
See Table 2-2. 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Thread 
Register Address: 34H, 52 MSR_SMI_COUNT 
SMI Counter (R/O) Thread 
31:0 SMI Count (R/O) 

Count SMls. 

63:32 Reserved. 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64 Processor (R/W) Thread 
See Table 2-2. 
0 Lock (R/WL) 
1 Enable VMX Inside SMX Operation (R/WL) 
2 Enable VMX Outside SMX Operation (R/WL) 
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Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
14:8 SENTER Local Functions Enables (R/WL) 
15 SENTER Global Functions Enable (R/WL) 
Register Address: 79H, 121 IA32_BIOS_UPDT_TRIG 
BIOS Update Trigger Register (W) Core 
See Table 2-2. 
Register Address: 8BH, 139 IA32_BlOS_SIGN_ID 
BIOS Update Signature ID (R/W) Thread 
See Table 2-2. 
Register Address: C1H, 193 IA32_PMCO 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C3H, 195 IA32_PMC2 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C4H, 196 IA32_PMC3 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C5H, 197 IA32_PMC4 
Performance Counter Register (if core not shared by threads) Core 
Register Address: C6H, 198 IA32_PMC5 
Performance Counter Register (if core not shared by threads) Core 
Register Address: C7H, 199 IA32_PMC6 
Performance Counter Register (if core not shared by threads) Core 
Register Address: C8H, 200 IA32_PMC7 
Performance Counter Register (if core not shared by threads) Core 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the frequency that invariant TSC runs at. Frequency = 
ratio * 100 MHz. 
27:16 Reserved. 
28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to 0, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 
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Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


ACPI C-States. 
See http://biosbits.org. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 


Register Information / Bit Fields Bit Description Scope 

29 Programmable TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDP Limit for Turbo mode is programmable. 
When set to 0, indicates TDP Limit for Turbo mode is not programmable. 

39:30 Reserved. 

47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 1OOMHz. 

63:48 Reserved. 

Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 

C-State Configuration Control (R/W) Core 


2:0 


9:3 


Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 


The following C-state code name encodings are supported: 
00Ob: CO/C1 (no package C-sate support) 

001b: C2 

010b: C6 no retention 

011b: C6 retention 

100b: C7 

101b: C7s 

111: No package C-state limit 

Note: This field cannot be used to limit package C-state to C3. 


Reserved. 


10 


1/0 MWAIT Redirection Enable (R/W) 


When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 


14:11 


Reserved. 


15 


CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 


24:16 


Reserved. 


25 


C3 State Auto Demotion Enable (R/W) 


When set, the processor will conditionally demote C6/C7 requests to C3 
based on uncore auto-demote information. 


26 


C1 State Auto Demotion Enable (R/W) 


When set, the processor will conditionally demote C3/C6/C7 requests to C1 
based on uncore auto-demote information. 


27 


Enable C3 Undemotion (R/W) 
When set, enables undemotion from demoted C3. 
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Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
28 Enable C1 Undemotion (R/W) 
When set, enables undemotion from demoted C1. 
63:29 Reserved. 
Register Address: E4H, 228 MSR_PMG_IO_CAPTURE_BASE 
Power Management IO Redirection in C-state (R/W) Core 
See http://biosbits.org. 
15:0 LVL_2 Base Address (R/W) 
Specifies the base address visible to software for IO redirection. If 10 
MWAIT Redirection is enabled, reads to this address will be consumed by 
the power management logic and decoded to MWAIT instructions. When IO 
port address redirection is enabled, this is the |O port address reported to 
the OS/software. 
18:16 C-State Range (R/W) 
Specifies the encoding value of the maximum C-State code name to be 
included when IO read to MWAIT redirection is enabled by 
MSR_PKG_CST_CONFIG_CONTROL|bit1 0}: 
000b - C3 is the max C-State to include. 
001b - C6 is the max C-State to include. 
010b - C7 is the max C-State to include. 
63:19 Reserved. 
Register Address: €7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
See Table 2-2. Thread 
Register Address: 13CH, 316 MSR_FEATURE_CONFIG 
AES Configuration (RW-L) Core 
Privileged post-BIOS agent must provide a #GP handler to handle unsuccessful read of this MSR. 
1:0 AES Configuration (RW-L) 
Upon a successful read of this MSR, the configuration of AES instruction 
set availability is as follows: 
11b: AES instructions are not available until next RESET. 
Otherwise, AES instructions are available. 
Note, AES instruction set is not available if read is unsuccessful. If the 
configuration is not 01b, AES instructions can be mis-configured if a 
privileged agent unintentionally writes 11b. 
63:2 Reserved. 
Register Address: 174H, 372 IA32_SYSENTER_CS 
See Table 2-2. Thread 
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Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

Register Address: 175H, 373 IA32_SYSENTER_ESP 
See Table 2-2. Thread 
Register Address: 176H, 374 IA32_SYSENTER_EIP 
See Table 2-2. Thread 
Register Address: 1 79H, 377 IA32_MCG_CAP 
See Table 2-2. Thread 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Thread 
0 RIPV 

When set, bit indicates that the instruction addressed by the instruction 

pointer pushed on the stack (when the machine check was generated) can 

be used to restart the program. If cleared, the program cannot be reliably 

restarted. 
1 EIPV 

When set, bit indicates that the instruction addressed by the instruction 

pointer pushed on the stack (when the machine check was generated) is 

directly associated with the error. 
2 MCIP 

When set, bit indicates that a machine check has been generated. If a 

second machine check is detected while this bit is still set, the processor 

enters a shutdown state. Software should write this bit to 0 after 

processing a machine check exception. 
63:3 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Thread 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Thread 
Register Address: 188H, 392 IA32_PERFEVTSEL2 
See Table 2-2. Thread 
Register Address: 189H, 393 IA32_PERFEVTSEL3 
See Table 2-2. Thread 
Register Address: 18AH, 394 IA32_PERFEVTSEL4 
See Table 2-2. If CPUID.OAH:EAX[15:8] > 4. Core 
Register Address: 18BH, 395 IA32_PERFEVTSEL5S 
See Table 2-2. If CPUID.OAH:EAX[15:8] > 5. Core 
Register Address: 18CH, 396 IA32_PERFEVTSEL6 
See Table 2-2. If CPUID.OAH:EAX[15:8] > 6. Core 
Register Address: 18DH, 397 IA32_PERFEVTSEL7 
See Table 2-2. If CPUID.OAH:EAX[15:8] > 7. Core 


Register Address: 198H, 408 


IA32_PERF_STATUS 
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Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
See Table 2-2. Package 
15:0 Current Performance State Value 
63:16 Reserved. 

Register Address: 198H, 408 MSR_PERF_STATUS 
Performance Status Package 
47:32 Core Voltage (R/O) 
P-state core voltage can be computed by 
MSR_PERF_STATUS[37:32] * (float) 1/(2*13). 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Thread 
Register Address: 19AH, 410 1A32_CLOCK_MODULATION 
Clock Modulation (R/W) Thread 
See Table 2-2. 
IA32_CLOCK_MODULATION MSR was originally named [A32_THERM_CONTROL MSR. 
3:0 On demand Clock Modulation Duty Cycle (R/W) 
In 6.25% increment. 
4 On demand Clock Modulation Enable (R/W) 
63:5 Reserved. 
Register Address: 19BH, 411 1A32_THERM_INTERRUPT 
Thermal Interrupt Control (R/W) Core 
See Table 2-2. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Core 
See Table 2-2. 
0 Thermal Status (R/O) 
See Table 2-2. 
1 Thermal Status Log (R/WCO) 
See Table 2-2. 
2 PROTCHOT # or FORCEPR# Status (R/O) 
See Table 2-2. 
3 PROTCHOT # or FORCEPR# Log (R/WCO) 
See Table 2-2. 
4 Critical Temperature Status (R/O) 
See Table 2-2. 
5 Critical Temperature Status Log (R/WCO) 
See Table 2-2. 
6 Thermal Threshold #1 Status (R/O) 
See Table 2-2. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

7 Thermal Threshold #1 Log (R/WCO) 
See Table 2-2. 

8 Thermal Threshold #2 Status (R/O) 
See Table 2-2. 

9 Thermal Threshold #2 Log (R/WCO) 
See Table 2-2. 

10 Power Limitation Status (R/O) 
See Table 2-2. 

11 Power Limitation Log (R/WCO) 
See Table 2-2. 

15:12 Reserved. 

22:16 Digital Readout (R/O) 
See Table 2-2. 

26:23 Reserved. 

30:27 Resolution in Degrees Celsius (R/O) 
See Table 2-2. 

31 Reading Valid (R/O) 
See Table 2-2. 

63:32 Reserved. 

Register Address: 1AQH, 416 IA32_MISC_ENABLE 

Enable Misc. Processor Features (R/W) 

Allows a variety of processor functions to be enabled and disabled. 

0) Fast-Strings Enable Thread 
See Table 2-2. 

6:1 Reserved. 
Performance Monitoring Available (R) Thread 
See Table 2-2. 

10:8 Reserved 

11 Branch Trace Storage Unavailable (R/O) Thread 
See Table 2-2. 

12 Processor Event Based Sampling Unavailable (R/O) Thread 
See Table 2-2. 

15:13 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) Package 
See Table 2-2. 

18 ENABLE MONITOR FSM (R/W) Thread 
See Table 2-2. 

21:19 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
22 Limit CPUID Maxval (R/W) Thread 
See Table 2-2. 
23 xTPR Message Disable (R/W) Thread 
See Table 2-2. 
33:24 Reserved. 
34 XD Bit Disable (R/W) Thread 
See Table 2-3. 
37:35 Reserved. 
38 Turbo Mode Disable (R/W) Package 
When set to 1 on processors that support Intel Turbo Boost Technology, 
the turbo mode feature is disabled and the IDA_Enable feature flag will be 
clear (CPUID.OGH: EAX[1]=0). 
When set to a O on processors that support IDA, CPUID.O6H: EAX[1] 
reports the processor's support of turbo mode is enabled. 
Note: The power-on default value is used by BIOS to detect hardware 
support of turbo mode. If the power-on default value is 1, turbo mode is 
available in the processor. If the power-on default value is 0, turbo mode is 
not available. 
63:39 Reserved. 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Unique 
15:0 Reserved. 
23:16 Temperature Target (R) 
The minimum temperature at which PROCHOT# will be asserted. The value 
is degrees C. 
63:24 Reserved. 
Register Address: 1A4H, 420 MSR_MISC_FEATURE_CONTROL 
Miscellaneous Feature Control (R/W) 
0 L2 Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L2 hardware prefetcher, which fetches additional lines of 
code or data into the L2 cache. 
1 L2 Adjacent Cache Line Prefetcher Disable (R/W) Core 
If 1, disables the adjacent cache line prefetcher, which fetches the cache 
line that comprises a cache line pair (128 bytes). 
2 DCU Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L1 data cache prefetcher, which fetches the next cache 
line into L1 data cache. 
3 DCU IP Prefetcher Disable (R/W) Core 
If 1, disables the L1 data cache IP prefetcher, which uses sequential load 
history (based on instruction pointer of previous loads) to determine 
whether to prefetch additional lines. 
63:4 Reserved. 


Register Address: 1A6H, 422 


MSR_OFFCORE_RSP_O 
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Register Information / Bit Fields Bit Description Scope 
Offcore Response Event Select Register (R/W) Thread 
Register Address: 1A7H, 423 MSR_OFFCORE_RSP_1 
Offcore Response Event Select Register (R/W) Thread 
Register Address: 1AAH, 426 MSR_MISC_PWR_MGMT 
Miscellaneous Power Management Control 
Various model specific features enumeration. See http://biosbits.org. 

Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 

See Table 2-2. Package 
Register Address: 1B1H, 433 IA32_PACKAGE_THERM_STATUS 

See Table 2-2. Package 
Register Address: 1B2H, 434 IA32_PACKAGE_THERM_INTERRUPT 

See Table 2-2. Package 
Register Address: 1C8H, 456 MSR_LBR_SELECT 

Last Branch Record Filtering Select Register (R/W) Thread 
See Section 18.9.2, “Filtering of Last Branch Records.” 

0 CPL_EQ_O 

1 CPL_NEQ_O 

2 JCC 

3 NEAR_REL_CALL 

4 NEAR_IND_CALL 

5 NEAR_RET 

6 NEAR_IND_JMP 

7 NEAR_REL_JMP 

8 FAR_BRANCH 

63:9 Reserved. 

Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 

Last Branch Record Stack TOS (R/W) Thread 
Contains an index (bits 0-3) that points to the MSR containing the most recent branch record. 

See MSR_LASTBRANCH_0O_FROM_IP (at 680H). 

Register Address: 1D9H, 473 IA32_DEBUGCTL 

Debug Control (R/W) Thread 
See Table 2-2. 

0 LBR: Last Branch Record 

1 BTF 

5:2 Reserved. 

6 TR: Branch Trace 

7 BTS: Log Branch Trace Message to BTS buffer 

8 BTINT 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
9 BTS_OFF_OS 
10 BTS_OFF_USER 
11 FREEZE_LBR_ON_PMI 
12 FREEZE_PERFMON_ON_PMI 
13 ENABLE_UNCORE_PMI 
14 FREEZE_WHILE_SMM 
63:15 Reserved. 
Register Address: 1DDH, 477 MSR_LER_FROM_LIP 
Last Exception Record From Linear IP (R/W) Thread 
Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 
Register Address: 1DEH, 478 MSR_LER_TO_LIP 
Last Exception Record To Linear IP (R/W) Thread 
This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 
Register Address: 1F2H, 498 IA32_SMRR_PHYSBASE 
See Table 2-2. Core 
Register Address: 1F3H, 499 IA32_SMRR_PHYSMASK 
See Table 2-2. Core 
Register Address: 1FCH, 508 MSR_POWER_CTL 
See http://biosbits.org. Core 
Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 
See Table 2-2. Thread 
Register Address: 201H, 513 IA32_MTRR_PHYSMASKO 
See Table 2-2. Thread 
Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 
See Table 2-2. Thread 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 
See Table 2-2. Thread 
Register Address: 204H, 516 1A32_MTRR_PHYSBASE2 
See Table 2-2. Thread 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 
See Table 2-2. Thread 
Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 
See Table 2-2. Thread 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 
See Table 2-2. Thread 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
See Table 2-2. Thread 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 
See Table 2-2. Thread 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 
See Table 2-2. Thread 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 
See Table 2-2. Thread 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 
See Table 2-2. Thread 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 
See Table 2-2. Thread 
Register Address: 20EH, 526 IA32_MTRR_PHYSBASE7 
See Table 2-2. Thread 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
See Table 2-2. Thread 
Register Address: 210H, 528 IA32_MTRR_PHYSBASE8 
See Table 2-2. Thread 
Register Address: 211H, 529 IA32_MTRR_PHYSMASK8 
See Table 2-2. Thread 
Register Address: 212H, 530 IA32_MTRR_PHYSBASE9 
See Table 2-2. Thread 
Register Address: 213H, 531 IA32_MTRR_PHYSMASK9 
See Table 2-2. Thread 
Register Address: 250H, 592 IA32_MTRR_FIX64K_O00000 
See Table 2-2. Thread 
Register Address: 258H, 600 1A32_MTRR_FIX16K_80000 
See Table 2-2. Thread 
Register Address: 259H, 601 1A32_MTRR_FIX16K_A0000 
See Table 2-2. Thread 
Register Address: 268H, 616 1A32_MTRR_FIX4K_CO000 
See Table 2-2. Thread 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Thread 
Register Address: 26AH, 618 IA32_MTRR_FIX4K_D0000 
See Table 2-2. Thread 
Register Address: 26BH, 619 1A32_MTRR_FIX4K_D8000 
See Table 2-2. Thread 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Thread 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Thread 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
See Table 2-2. Thread 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
See Table 2-2. Thread 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Thread 
Register Address: 280H, 640 IA32_MCO_CTL2 
See Table 2-2. Core 
Register Address: 281H, 641 IA32_MC1_CTL2 
See Table 2-2. Core 
Register Address: 282H, 642 IA32_MC2_CTL2 
See Table 2-2. Core 
Register Address: 283H, 643 IA32_MC3_CTL2 
See Table 2-2. Core 
Register Address: 284H, 644 IA32_MC4_CTL2 
Always 0 (CMCI not supported). Package 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Thread 
See Table 2-2. 
Register Address: 309H, 777 IA32_FIXED_CTRO 
Fixed-Function Performance Counter Register 0 (R/W) Thread 
See Table 2-2. 
Register Address: 30AH, 778 IA32_FIXED_CTR1 
Fixed-Function Performance Counter Register 1 (R/W) Thread 
See Table 2-2. 
Register Address: 30BH, 779 IA32_FIXED_CTR2 
Fixed-Function Performance Counter Register 2 (R/W) Thread 
See Table 2-2. 
Register Address: 345H, 837 1A32_PERF_CAPABILITIES 
See Table 2-2 and Section 18.4.1, “IA32_DEBUGCTL MSR.” Thread 
5:0 LBR Format 

See Table 2-2. 

6 PEBS Record Format. 
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Register Information / Bit Fields Bit Description Scope 

7 PEBSSaveArchRegs 

See Table 2-2. 
11:8 PEBS_REC_FORMAT 

See Table 2-2. 
12 SMM_FREEZE 

See Table 2-2. 
63:13 Reserved. 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 
Fixed-Function-Counter Control Register (R/W) Thread 
See Table 2-2. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2 and Section 20.6.2.2, “Global Counter Control Facilities.” 
0 Ovf_PMCO Thread 
1 Ovf_PMC1 Thread 
2 Ovf_PMC2 Thread 
3 Ovf_PMC3 Thread 
4 Ovf_PMC4 (if CPUID.OAH:EAX[1 5:8] > 4) Core 
5 Ovf_PMCS5 (if CPUID.OAH:EAX[1 5:8] > 5) Core 
6 Ovf_PMC6 (if CPUID.OAH:EAX[1 5:8] > 6) Core 
7 Ovf_PMC7 (if CPUID.OAH:EAX[1 5:8] > 7) Core 
31:8 Reserved. 
32 Ovf_FixedCtrO Thread 
33 Ovf_FixedCtr1 Thread 
34 Ovf_FixedCtr2 Thread 
60:35 Reserved. 
61 Ovf_Uncore Thread 
62 Ovf_BufDSSAVE Thread 
63 CondChgd Thread 
Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 
See Table 2-2 and Section 20.6.2.2, “Global Counter Control Facilities.” Thread 
0 Set 1 to enable PMCO to count. Thread 
1 Set 1 to enable PMC1 to count. Thread 
2 Set 1 to enable PMC2 to count. Thread 
3 Set 1 to enable PMC3 to count. Thread 
4 Set 1 to enable PMC4 to count (if CPUID.OAH:EAX[1 5:8] > 4). Core 
5 Set 1 to enable PMC5 to count (if CPUID.OAH:EAX[1 5:8] > 5). Core 
6 Set 1 to enable PMC6 to count (if CPUID.OAH:EAX[1 5:8] > 6). Core 
7 Set 1 to enable PMC7 to count (if CPUID.OAH:EAX[1 5:8] > 7). Core 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
31:8 Reserved. 
32 Set 1 to enable FixedCtr0 to count. Thread 
33 Set 1 to enable FixedCtr1 to count. Thread 
34 Set 1 to enable FixedCtr2 to count. Thread 
63:35 Reserved. 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2 and Section 20.6.2.2, “Global Counter Control Facilities.” 
0 Set 1 to clear Ovf_PMCO. Thread 
1 Set 1 to clear Ovf_PMC1. Thread 
2 Set 1 to clear Ovf_PMC2. Thread 
3 Set 1 to clear Ovf_PMC3. Thread 
4 Set 1 to clear Ovf_PMC4 (if CPUID.OAH:EAX[1 5:8] > 4). Core 
5 Set 1 to clear Ovf_PMC5 (if CPUID.OAH:EAX[1 5:8] > 5). Core 
6 Set 1 to clear Ovf_PMC6 (if CPUID.OAH:EAX[1 5:8] > 6). Core 
7 Set 1 to clear Ovf_PMC7 (if CPUID.OAH:EAX[1 5:8] > 7). Core 
31:8 Reserved. 
32 Set 1 to clear Ovf_FixedCtr0. Thread 
33 Set 1 to clear Ovf_FixedCtr1. Thread 
34 Set 1 to clear Ovf_FixedCtr2. Thread 
60:35 Reserved. 
61 Set 1 to clear Ovf_Uncore. Thread 
62 Set 1 to clear Ovf_BufDSSAVE. Thread 
63 Set 1 to clear CondChad. Thread 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
See Section 20.3.1.1.1, “Processor Event Based Sampling (PEBS).” Thread 
0 Enable PEBS on IA32_PMCO. (R/W) 
1 Enable PEBS on IA32_PMC1. (R/W) 
2 Enable PEBS on IA32_PMC2. (R/W) 
3 Enable PEBS on IA32_PMC3. (R/W) 
31:4 Reserved. 
32 Enable Load Latency on IA32_PMCO. (R/W) 
33 Enable Load Latency on IA32_PMC1. (R/W) 
34 Enable Load Latency on IA32_PMC2. (R/W) 
35 Enable Load Latency on IA32_PMC3. (R/W) 
62:36 Reserved. 
63 Enable Precise Store (R/W) 
Register Address: 3F6H, 1014 MSR_PEBS_LD_LAT 
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Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
See Section 20.3.1.1.2, “Load Latency Performance Monitoring Facility.” Thread 
15:0 Minimum threshold latency value of tagged load operation that will be 

counted. (R/W) 
63:36 Reserved. 
Register Address: 3F8H, 1016 MSR_PKG_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C3 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C3 states. 
Count at the same frequency as the TSC. 
Register Address: 3F9H, 1017 MSR_PKG_C6_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C6 Residency Counter. (R/O) 
Value since last reset that this package is in processor-specific C6 states. 
Count at the same frequency as the TSC. 
Register Address: 3FAH, 1018 MSR_PKG_C7_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C7 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C7 states. 
Count at the same frequency as the TSC. 
Register Address: 3FCH, 1020 MSR_CORE_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 
63:0 CORE C3 Residency Counter (R/O) 
Value since last reset that this core is in processor-specific C3 states. Count 
at the same frequency as the TSC. 
Register Address: 3FDH, 1021 MSR_CORE_C6_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 
63:0 CORE C6 Residency Counter (R/O) 
Value since last reset that this core is in processor-specific C6 states. Count 
at the same frequency as the TSC. 
Register Address: 3FEH, 1022 MSR_CORE_C7_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Core 
ACPI C-States. 
63:0 CORE C7 Residency Counter (R/O) 
Value since last reset that this core is in processor-specific C7 states. Count 
at the same frequency as the TSC. 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 401H, 1025 1A32_MCO_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Core 
Register Address: 402H, 1026 IA32_MCO_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 403H, 1027 IA32_MCO_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Register Address: 404H, 1028 IA32_MC1_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 405H, 1029 IA32_MC1_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Core 
Register Address: 406H, 1030 IA32_MC1_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 407H, 1031 IA32_MC1_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Register Address: 408H, 1032 IA32_MC2_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 409H, 1033 IA32_MC2_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Core 
Register Address: 40AH, 1034 IA32_MC2_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Core 
Register Address: 40BH, 1035 IA32_MC2_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Register Address: 40CH, 1036 IA32_MC3_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 40DH, 1037 IA32_MC3_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Core 
Register Address: 40EH, 1038 IA32_MC3_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 40FH, 1039 IA32_MC3_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Register Address: 410H, 1040 IA32_MC4_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 


0 PCU Hardware Error (R/W) 

When set, enables signaling of PCU hardware detected errors. 
1 PCU Controller Error (R/W) 

When set, enables signaling of PCU controller detected errors. 
2 PCU Firmware Error (R/W) 


When set, enables signaling of PCU firmware detected errors. 
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63:2 Reserved. 


Register Address: 411H, 1041 IA32_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. 


Core 


Register Address: 480H, 1152 IA32_VMX_BASIC 


Reporting Register of Basic VMX Capabilities (R/O) 
See Table 2-2 and Appendix A.1, “Basic VMX Information.” 


Thread 


Register Address: 481H, 1153 1A32_VMX_PINBASED_CTLS 


See Table 2-2 and Appendix A.3, “VM-Execution Controls.” 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) 


Thread 


Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 


See Appendix A.3, “VM-Execution Controls.” 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) 


Thread 


Register Address: 483H, 1155 IA32_WMX_EXIT_CTLS 


Capability Reporting Register of VM-Exit Controls (R/O) 
See Table 2-2 and Appendix A.4, “VM-Exit Controls.” 


Thread 


Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 


Capability Reporting Register of VM-Entry Controls (R/O) 
See Table 2-2 and Appendix A.5, “VM-Entry Controls.” 


Thread 


Register Address: 485H, 1157 IA32_VMX_MISC 


Reporting Register of Miscellaneous VMX Capabilities (R/O) 
See Table 2-2 and Appendix A.6, “Miscellaneous Data.” 


Thread 


Register Address: 486H, 1158 1A32_WVMX_CRO_FIXEDO 


Capability Reporting Register of CRO Bits Fixed to 0 (R/O) 
See Table 2-2 and Appendix A.7, “VMX-Fixed Bits in CRO." 


Thread 


Register Address: 487H, 1159 IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO Bits Fixed to 1 (R/O) 
See Table 2-2 and Appendix A.7, “VMX-Fixed Bits in CRO." 


Thread 


Register Address: 488H, 1160 IA32_WMX_CR4_FIXEDO 


Capability Reporting Register of CR4 Bits Fixed to O (R/O) 
See Table 2-2 and Appendix A.8, “VMX-Fixed Bits in CR4." 


Thread 


Register Address: 489H, 1161 IA32_WMX_CR4_FIX€D1 


Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) 
See Table 2-2 and Appendix A.8, “VMX-Fixed Bits in CR4." 


Thread 


Register Address: 48AH, 1162 1A32_WMX_VMCS_ENUM 


Capability Reporting Register of VMCS Field Enumeration (R/O) 
See Table 2-2 and Appendix A.9, “VMCS Enumeration.” 


Thread 


Register Address: 48BH, 1163 IA32_WMX_PROCBASED_CTLS2 


See Appendix A.3, “VM-Execution Controls.” 


Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) 


Thread 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 48CH, 1164 IA32_VMX_EPT_VPID_ENUM 
Capability Reporting Register of EPT and VPID (R/O) Thread 
See Table 2-2 
Register Address: 48DH, 1165 IA32_VMX_TRUE_PINBASED_CTLS 
Capability Reporting Register of Pin-Based VM-Execution Flex Controls (R/O) Thread 
See Table 2-2 
Register Address: 48EH, 1166 IA32_VMX_TRUE_PROCBASED_CTLS 
Capability Reporting Register of Primary Processor-Based VM-Execution Flex Controls (R/O) Thread 
See Table 2-2 
Register Address: 48FH, 1167 IA32_VMX_TRUE_EXIT_CTLS 
Capability Reporting Register of VM-Exit Flex Controls (R/O) Thread 
See Table 2-2 
Register Address: 490H, 1168 IA32_VMX_TRUE_ENTRY_CTLS 
Capability Reporting Register of VM-Entry Flex Controls (R/O) Thread 
See Table 2-2 
Register Address: 4C1H, 1217 IA32_A_PMCO 
See Table 2-2. Thread 
Register Address: 4C2H, 1218 IA32_A_PMC1 
See Table 2-2. Thread 
Register Address: 4C3H, 1219 IA32_A_PMC2 
See Table 2-2. Thread 
Register Address: 4C4H, 1220 IA32_A_PMC3 
See Table 2-2. Thread 
Register Address: 4C5H, 1221 IA32_A_PMC4 
See Table 2-2. Core 
Register Address: 4C6H, 1222 IA32_A_PMC5 
See Table 2-2. Core 
Register Address: 4C7H, 1223 IA32_A_PMC6 
See Table 2-2. Core 
Register Address: 4C8H, 1224 IA32_A_PMC7 
See Table 2-2. Core 
Register Address: 600H, 1536 IA32_DS_AREA 
DS Save Area (R/W) Thread 
See Table 2-2 and Section 20.6.3.4, “Debug Store (DS) Mechanism.” 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers used in RAPL Interfaces (R/O) Package 
See Section 15.10.1, “RAPL Interfaces.” 
Register Address: 60AH, 1546 MSR_PKGC3_IRTL 
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This MSR defines the budget allocated for the package to exit from a C6 to a CO state, where an interrupt request can 
be delivered to the core and serviced. Additional core-exit latency may be applicable depending on the actual C-state 
the core is in. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Package C3 Interrupt Response Limit (R/W) Package 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 

9:0 Interrupt Response Time Limit (R/W) 
Specifies the limit that should be used to decide if the package should be 
put into a package C3 state. 
12:10 Time Unit (R/w) 
Specifies the encoding value of time unit of the interrupt response time 
limit. The following time unit encodings are supported: 
OOOb: 1 ns 
001b: 32 ns 
010b: 1024 ns 
011b: 32768 ns 
100b: 1048576 ns 
101b: 33554432 ns 
14:13 Reserved. 
15 Valid (R/w) 
Indicates whether the values in bits 12:0 are valid and can be used by the 
processor for package C-sate management. 
63:16 Reserved. 
Register Address: 60BH, 1547 MSR_PKGC6_IRTL 
Package C6 Interrupt Response Limit (R/W) Package 


9:0 Interrupt Response Time Limit (R/W) 


Specifies the limit that should be used to decide if the package should be 
put into a package C6 state. 


12:10 Time Unit (R/W) 


Specifies the encoding value of time unit of the interrupt response time 
limit. The following time unit encodings are supported: 


OOOb: 1 ns 

001b: 32 ns 

010b: 1024 ns 
011b: 32768 ns 
100b: 1048576 ns 
101b: 33554432 ns 


14:13 Reserved. 


15 Valid (R/W) 


Indicates whether the values in bits 12:0 are valid and can be used by the 
processor for package C-sate management. 


2-214 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-20. MSRs Supported by Intel® Processors Based on Sandy Bridge Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
63:16 Reserved. 
Register Address: 60DH, 1549 MSR_PKG_C2_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
63:0 Package C2 Residency Counter (R/O) 

Value since last reset that this package is in processor-specific C2 states. 
Count at the same frequency as the TSC. 

Register Address: 610H, 1552 MSR_PKG_POWER_LIMIT 
PKG RAPL Power Limit Control (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 611H, 1553 MSR_PKG_ENERGY_STATUS 
PKG Energy Status (R/O) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 614H, 1556 MSR_PKG_POWER_INFO 
PKG RAPL Parameters (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 638H, 1592 MSR_PPO_POWER_LIMIT 
PPO RAPL Power Limit Control (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains." 
Register Address: 680H, 1664 MSR_LASTBRANCH_O_FROM_IP 
Last Branch Record 0 From IP (R/W) Thread 
One of sixteen pairs of last branch record registers on the last branch record stack. This part of the stack contains 
pointers to the source instruction. See also: 
« Last Branch Record Stack TOS at 1C9SH. 
* Section 18.9.1 and record format in Section 18.4.8.1. 
Register Address: 681H, 1665 MSR_LASTBRANCH_1_FROM_IP 
Last Branch Record 1 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 682H, 1666 MSR_LASTBRANCH_2_FROM_IP 
Last Branch Record 2 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 683H, 1667 MSR_LASTBRANCH_3_FROM_IP 
Last Branch Record 3 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 684H, 1668 MSR_LASTBRANCH_4_ FROM_IP 
Last Branch Record 4 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 685H, 1669 MSR_LASTBRANCH_5_FROM_IP 
Last Branch Record 5 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 686H, 1670 MSR_LASTBRANCH_6_FROM_IP 
Last Branch Record 6 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 687H, 1671 MSR_LASTBRANCH_7_FROM_IP 
Last Branch Record 7 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 688H, 1672 MSR_LASTBRANCH_8_FROM_IP 
Last Branch Record 8 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 689H, 1673 MSR_LASTBRANCH_9_FROM_IP 
Last Branch Record 9 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68AH, 1674 MSR_LASTBRANCH_10_FROM_IP 
Last Branch Record 10 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68BH, 1675 MSR_LASTBRANCH_11_FROM_IP 
Last Branch Record 11 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68CH, 1676 MSR_LASTBRANCH_12_FROM_IP 
Last Branch Record 12 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68DH, 1677 MSR_LASTBRANCH_13_FROM_IP 
Last Branch Record 13 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68EH, 1678 MSR_LASTBRANCH_14_FROM_IP 
Last Branch Record 14 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 68FH, 1679 MSR_LASTBRANCH_15_FROM_IP 
Last Branch Record 15 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 6COH, 1728 MSR_LASTBRANCH_O_TO_IP 
Last Branch Record 0 To IP (R/W) Thread 
One of sixteen pairs of last branch record registers on the last branch record stack. This part of the stack contains 
pointers to the destination instruction. 
Register Address: 6C1H, 1729 MSR_LASTBRANCH_1_TO_IP 
Last Branch Record 1 To IP (R/W) Thread 


See description of MSR_LASTBRANCH_O_TO_IP. 


Register Address: 6C2H, 1730 


MSR_LASTBRANCH_2_TO_IP 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Last Branch Record 2 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C3H, 1731 MSR_LASTBRANCH_3_TO_IP 

Last Branch Record 3 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C4H, 1732 MSR_LASTBRANCH_4_TO_IP 

Last Branch Record 4 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C5H, 1733 MSR_LASTBRANCH_5_TO_IP 

Last Branch Record 5 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C6H, 1734 MSR_LASTBRANCH_6_TO_IP 

Last Branch Record 6 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C7H, 1735 MSR_LASTBRANCH_7_TO_IP 

Last Branch Record 7 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6C8H, 1736 MSR_LASTBRANCH_8_TO_IP 

Last Branch Record 8 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CSH, 1737 MSR_LASTBRANCH_S_TO_IP 

Last Branch Record 9 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CAH, 1738 MSR_LASTBRANCH_10_TO_IP 

Last Branch Record 10 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CBH, 1739 MSR_LASTBRANCH_11_TO_IP 

Last Branch Record 11 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CCH, 1740 MSR_LASTBRANCH_12_TO_IP 

Last Branch Record 12 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CDH, 1741 MSR_LASTBRANCH_13_TO_IP 

Last Branch Record 13 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CEH, 1742 MSR_LASTBRANCH_14_TO_IP 

Last Branch Record 14 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6CFH, 1743 MSR_LASTBRANCH_15_TO_IP 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See Table 2-2. 


Register Information / Bit Fields Bit Description Scope 
Last Branch Record 15 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6E0H, 1760 IA32_TSC_DEADLINE 

See Table 2-2. Thread 
Register Address: 802H—83FH, 2050— | X2APIC MSRs 

2111 

See Table 2-2. Thread 
Register Address: COOO_O080H IA32_EFER 

Extended Feature Enables Thread 
See Table 2-2. 

Register Address: COOO_0081H IA32_STAR 

System Call Target Address (R/W) Thread 


See Table 2-2. 


Register Address: COOO_0084H IA32_FMASK 


Register Address: COOO_0082H IA32_LSTAR 


IA-32e Mode System Call Target Address (R/W) 


Thread 


System Call Flag Mask (R/W) 
See Table 2-2. 


Thread 


Register Address: CO00_0100H IA32_FS_BASE 


Map of BASE Address of FS (R/W) 
See Table 2-2. 


Thread 


Map of BASE Address of GS (R/W) 
See Table 2-2. 


Register Address: COO0_0101H IA32_GS_BASE 


Thread 


Register Address: COO0_0102H 


IA32_KERNEL_GS_BASE 


Swap Target of BASE Address of GS (R/W) 
See Table 2-2. 


Thread 


Register Address: COO0_0103H IA32_TSC_AUX 


AUXILIARY TSC Signature (R/W) 


See Table 2-2 and Section 18.17.2, "IA32_TSC_AUX Register and RDTSCP Support.” 


Thread 


2.11.1 MSRs in the 2nd Generation Intel® Core™ Processor Family Based on Sandy Bridge 


Microarchitecture 


Table 2-21 and Table 2-22 list model-specific registers (MSRs) that are specific to the 2nd generation Intel® Core™ 


processor family based on the Sandy Bridge microarchitecture. These processors have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_2AH; see Table 2-1. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Maximum Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0. 
R/W if MSR_PLATFORM_INFO.[28] = 1. 
7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 
15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 
23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 
31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 
63:32 Reserved. 
Register Address: 60CH, 1548 MSR_PKGC7_IRTL 
Package C7 Interrupt Response Limit (R/W) Package 
This MSR defines the budget allocated for the package to exit from a C7 to a CO state, where interrupt request can be 
delivered to the core and serviced. Additional core-exit latency may be applicable depending on the actual C-state the 
core is in. 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. 
9:0 Interrupt Response Time Limit (R/W) 
Specifies the limit that should be used to decide if the package should be 
put into a package C7 state. 
12:10 Time Unit (R/W) 
Specifies the encoding value of time unit of the interrupt response time 
limit. The following time unit encodings are supported: 
OOOb: 1 ns 
001b: 32 ns 
010b: 1024 ns 
011b: 32768 ns 
100b: 1048576 ns 
101b: 33554432 ns 
14:13 Reserved. 
15 Valid (R/w) 
Indicates whether the values in bits 12:0 are valid and can be used by 
the processor for package C-sate management. 
63:16 Reserved. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 63AH, 1594 MSR_PPO_POLICY 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
PPO Balance Policy (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 

Register Address: 640H, 1600 MSR_PP1_POWER_LIMIT 

PP1 RAPL Power Limit Control (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 

Register Address: 641H, 1601 MSR_PP1_ENERGY_STATUS 

PP1 Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 

Register Address: 642H, 1602 MSR_PP1_POLICY 

PP1 Balance Policy (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 


See Table 2-20, Table 2-21, and Table 2-22 for MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_2AH. 


Table 2-22 lists the MSRs of uncore PMU for Intel processors with a CPUID Signature DisplayFamily_DisplayModel 
value of 06_2AH. 


Table 2-22. Uncore PMU MSRs Supported by 2nd Generation Intel® Core™ Processors 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 391H, 913 MSR_UNC_PERF_GLOBAL_CTRL 
Uncore PMU Global Control Package 
0 Slice 0 select. 
1 Slice 1 select. 
2 Slice 2 select. 
3 Slice 3 select. 
4 Slice 4 select. 
18:5 Reserved. 
29 Enable all uncore counters. 
30 Enable wake on PMI. 
31 Enable Freezing counter when overflow. 
63:32 Reserved. 
Register Address: 392H, 914 MSR_UNC_PERF_GLOBAL_STATUS 
Uncore PMU Main Status Package 
0 Fixed counter overflowed. 
1 An ARB counter overflowed. 
2 Reserved. 
3 A CBox counter overflowed (on any slice). 
63:4 Reserved. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 394H, 916 MSR_UNC_PERF_FIXED_CTRL 
Uncore Fixed Counter Control (R/W) Package 
19:0 Reserved. 
20 Enable overflow propagation. 
21 Reserved. 
22 Enable counting. 
63:23 Reserved. 
Register Address: 395H, 917 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
47:0 Current count. 
63:48 Reserved. 
Register Address: 396H, 918 MSR_UNC_CBO_CONFIG 
Uncore C-Box Configuration Information (R/O) Package 
3:0 Report the number of C-Box units with performance counters, including 

processor cores and processor graphics. 

63:4 Reserved. 
Register Address: 3BOH, 946 MSR_UNC_ARB_PERFCTRO 
Uncore Arb Unit, Performance Counter 0 Package 
Register Address: 3B1H, 947 MSR_UNC_ARB_PERFCTR1 
Uncore Arb Unit, Performance Counter 1 Package 
Register Address: 3B2H, 944 MSR_UNC_ARB_PERFEVTSELO 
Uncore Arb Unit, Counter O Event Select MSR Package 
Register Address: 3B3H, 945 MSR_UNC_ARB_PERFEVTSEL1 
Uncore Arb unit, Counter 1 Event Select MSR Package 
Register Address: 700H, 1792 MSR_UNC_CBO_O_PERFEVTSELO 
Uncore C-Box 0, Counter O Event Select MSR Package 
Register Address: 701H, 1793 MSR_UNC_CBO_O_PERFEVTSEL1 
Uncore C-Box 0, Counter 1 Event Select MSR Package 
Register Address: 702H, 1794 MSR_UNC_CBO_O_PERFEVTSEL2 
Uncore C-Box 0, Counter 2 Event Select MSR Package 
Register Address: 703H, 1795 MSR_UNC_CBO_O_PERFEVTSEL3 
Uncore C-Box 0, Counter 3 Event Select MSR Package 
Register Address: 705H, 1797 MSR_UNC_CBO_O_UNIT_STATUS 
Uncore C-Box 0, Unit Status for Counter 0-3 Package 
Register Address: 706H, 1798 MSR_UNC_CBO_0_PERFCTRO 
Uncore C-Box 0, Performance Counter O Package 
Register Address: 707H, 1799 MSR_UNC_CBO_O_PERFCTR1 
Uncore C-Box 0, Performance Counter 1 Package 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

Register Address: 708H, 1800 MSR_UNC_CBO_0_PERFCTR2 

Uncore C-Box 0, Performance Counter 2 Package 
Register Address: 709H, 1801 MSR_UNC_CBO_O_PERFCTR3 

Uncore C-Box 0, Performance Counter 3 Package 
Register Address: 710H, 1808 MSR_UNC_CBO_1_PERFEVTSELO 

Uncore C-Box 1, Counter O Event Select MSR Package 
Register Address: 711H, 1809 MSR_UNC_CBO_1_PERFEVTSEL1 

Uncore C-Box 1, Counter 1 Event Select MSR Package 
Register Address: 712H, 1810 MSR_UNC_CBO_1_PERFEVTSEL2 

Uncore C-Box 1, Counter 2 Event Select MSR Package 
Register Address: 713H, 1811 MSR_UNC_CBO_1_PERFEVTSEL3 

Uncore C-Box 1, Counter 3 Event Select MSR Package 
Register Address: 715H, 1813 MSR_UNC_CBO_1_UNIT_STATUS 

Uncore C-Box 1, Unit Status for Counter 0-3 Package 
Register Address: 716H, 1814 MSR_UNC_CBO_1_PERFCTRO 

Uncore C-Box 1, Performance Counter 0 Package 
Register Address: 717H, 1815 MSR_UNC_CBO_1_PERFCTR1 

Uncore C-Box 1, Performance Counter 1 Package 
Register Address: 718H, 1816 MSR_UNC_CBO_1_PERFCTR2 

Uncore C-Box 1, Performance Counter 2 Package 
Register Address: 719H, 1817 MSR_UNC_CBO_1_PERFCTR3 

Uncore C-Box 1, Performance Counter 3 Package 
Register Address: 720H, 1824 MSR_UNC_CBO_2_PERFEVTSELO 

Uncore C-Box 2, Counter O Event Select MSR Package 
Register Address: 721H, 1825 MSR_UNC_CBO_2_PERFEVTSEL1 

Uncore C-Box 2, Counter 1 Event Select MSR Package 
Register Address: 722H, 1826 MSR_UNC_CBO_2_PERFEVTSEL2 

Uncore C-Box 2, Counter 2 Event Select MSR Package 
Register Address: 723H, 1827 MSR_UNC_CBO_2_PERFEVTSEL3 

Uncore C-Box 2, Counter 3 Event Select MSR Package 
Register Address: 725H, 1829 MSR_UNC_CBO_2_UNIT_STATUS 

Uncore C-Box 2, Unit Status for Counter 0-3 Package 
Register Address: 726H, 1830 MSR_UNC_CBO_2_PERFCTRO 

Uncore C-Box 2, Performance Counter 0 Package 
Register Address: 727H, 1831 MSR_UNC_CBO_2_PERFCTR1 

Uncore C-Box 2, Performance Counter 1 Package 


Register Address: 728H, 1832 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 3, Performance Counter 2 Package 
Register Address: 729H, 1833 MSR_UNC_CBO_3_PERFCTR3 
Uncore C-Box 3, Performance Counter 3 Package 
Register Address: 730H, 1840 MSR_UNC_CBO_3_PERFEVTSELO 
Uncore C-Box 3, Counter O Event Select MSR Package 
Register Address: 731H, 1841 MSR_UNC_CBO_3_PERFEVTSEL1 
Uncore C-Box 3, Counter 1 Event Select MSR Package 
Register Address: 732H, 1842 MSR_UNC_CBO_3_PERFEVTSEL2 
Uncore C-Box 3, Counter 2 Event Select MSR Package 
Register Address: 733H, 1843 MSR_UNC_CBO_3_PERFEVTSEL3 
Uncore C-Box 3, counter 3 Event Select MSR Package 
Register Address: 735H, 1845 MSR_UNC_CBO_3_UNIT_STATUS 
Uncore C-Box 3, Unit Status for Counter 0-3 Package 
Register Address: 736H, 1846 MSR_UNC_CBO_3_PERFCTRO 
Uncore C-Box 3, Performance Counter 0 Package 
Register Address: 737H, 1847 MSR_UNC_CBO_3_PERFCTR1 
Uncore C-Box 3, Performance Counter 1 Package 
Register Address: 738H, 1848 MSR_UNC_CBO_3_PERFCTR2 
Uncore C-Box 3, Performance Counter 2 Package 
Register Address: 739H, 1849 MSR_UNC_CBO_3_PERFCTR3 
Uncore C-Box 3, Performance Counter 3 Package 
Register Address: 740H, 1856 MSR_UNC_CBO_4_PERFEVTSELO 
Uncore C-Box 4, Counter O Event Select MSR Package 
Register Address: 741H, 1857 MSR_UNC_CBO_4_PERFEVTSEL1 
Uncore C-Box 4, Counter 1 Event Select MSR Package 
Register Address: 742H, 1858 MSR_UNC_CBO_4_PERFEVTSEL2 
Uncore C-Box 4, Counter 2 Event Select MSR Package 
Register Address: 743H, 1859 MSR_UNC_CBO_4_PERFEVTSEL3 
Uncore C-Box 4, Counter 3 Event Select MSR Package 
Register Address: 745H, 1861 MSR_UNC_CBO_4_UNIT_STATUS 
Uncore C-Box 4, Unit status for Counter 0-3 Package 
Register Address: 746H, 1862 MSR_UNC_CBO_4_PERFCTRO 
Uncore C-Box 4, Performance Counter 0 Package 
Register Address: 747H, 1863 MSR_UNC_CBO_4_PERFCTR1 
Uncore C-Box 4, Performance Counter 1 Package 
Register Address: 748H, 1864 MSR_UNC_CBO_4_PERFCTR2 
Uncore C-Box 4, Performance Counter 2 Package 
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Table 2-22. Uncore PMU MSRs Supported by 2nd Generation Intel® Core™ Processors (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 749H, 1865 MSR_UNC_CBO_4_PERFCTR3 
Uncore C-Box 4, Performance Counter 3 Package 


2.11.2 |MSRs in the Intel® Xeon® Processor E5 Family Based on Sandy Bridge 
Microarchitecture 
Table 2-23 lists additional model-specific registers (MSRs) that are specific to the Intel® Xeon® Processor E5 Family 


based on Sandy Bridge microarchitecture. These processors have a CPUID Signature DisplayFamily_DisplayModel 
value of 06_2DH, and also support MSRs listed in Table 2-20 and Table 2-24. 


Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 17FH, 383 MSR_ERROR_CONTROL 
MC Bank Error Configuration (R/W) Package 

0 Reserved. 

1 Mem€Error Log Enable (R/W) 
When set, enables IMC status bank to log additional info in bits 36:32. 

63:2 Reserved. 

Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO.[28] = 0. R/W if MSR_PLATFORM_INFO.[28] = 1. 

7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 cores active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 cores active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 cores active. 

39:32 Maximum Ratio Limit for 5C Package 
Maximum turbo ratio limit of 5 cores active. 

47:40 Maximum Ratio Limit for 6C Package 
Maximum turbo ratio limit of 6 cores active. 

55:48 Maximum Ratio Limit for 7C Package 
Maximum turbo ratio limit of 7 cores active. 

63:56 Maximum Ratio Limit for 8C Package 
Maximum turbo ratio limit of 8 cores active. 

Register Address: 285H, 645 IA32_MC5_CTL2 

See Table 2-2. Package 
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Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 
See Table 2-2. Package 
Register Address: 288H, 648 IA32_MC8_CTL2 
See Table 2-2. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 
See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 
See Table 2-2. Package 
Register Address: 28BH, 651 IA32_MC11_CTL2 
See Table 2-2. Package 
Register Address: 28CH, 652 IA32_MC12_CTL2 
See Table 2-2. Package 
Register Address: 28DH, 653 IA32_MC13_CTL2 
See Table 2-2. Package 
Register Address: 28€H, 654 IA32_MC14_CTL2 
See Table 2-2. Package 
Register Address: 28FH, 655 IA32_MC15_CTL2 
See Table 2-2. Package 
Register Address: 290H, 656 IA32_MC16_CTL2 
See Table 2-2. Package 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 39CH, 924 MSR_PEBS_NUM_ALT 
ENABLE_PEBS_NUM_ALT (R/W) Package 
0 ENABLE_PEBS_NUM_ALT (R/W) 

Write 1 to enable alternate PEBS counting logic for specific events 
requiring additional configuration, see https://perfmon-events.intel.com/, 

63:1 Reserved, must be zero. 
Register Address: 414H, 1044 IA32_MC5_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 415H, 1045 IA32_MC5_STATUS 
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Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 
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Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 416H, 1046 IA32_MC5_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 41 7H, 1047 IA32_MC5_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 418H, 1048 IA32_MC6_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 419H, 1049 IA32_MC6_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 41AH, 1050 IA32_MC6_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 41BH, 1051 IA32_MC6_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 41CH, 1052 IA32_MC7_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 41DH, 1053 IA32_MC7_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 41€H, 1054 IA32_MC7_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 41FH, 1055 IA32_MC7_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 420H, 1056 IA32_MC8_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 421H, 1057 IA32_MC8_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 422H, 1058 IA32_MC8_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 423H, 1059 IA32_MC8_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 424H, 1060 IA32_MC9_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 425H, 1061 IA32_MC9_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 426H, 1062 IA32_MC9_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 427H, 1063 IA32_MC9_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 428H, 1064 IA32_MC10_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 429H, 1065 IA32_MC10_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 42AH, 1066 IA32_MC10_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 42BH, 1067 IA32_MC10_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 42CH, 1068 IA32_MC11_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs.” Package 
Register Address: 42DH, 1069 IA32_MC11_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 42EH, 1070 IA32_MC11_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 42FH, 1071 IA32_MC11_MISC 
See Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Register Address: 430H, 1072 IA32_MC12_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 431H, 1073 IA32_MC12_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 432H, 1074 IA32_MC12_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 433H, 1075 IA32_MC12_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 434H, 1076 IA32_MC13_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 435H, 1077 IA32_MC13_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 436H, 1078 IA32_MC13_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 437H, 1079 IA32_MC13_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 438H, 1080 IA32_MC14_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs.” Package 
Register Address: 439H, 1081 IA32_MC14_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 


Register Address: 43AH, 1082 


IA32_MC14_ADDR 
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Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 
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Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 43BH, 1083 IA32_MC14_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 43CH, 1084 IA32_MC15_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 43DH, 1085 IA32_MC15_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 43€H, 1086 IA32_MC15_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 43FH, 1087 IA32_MC15_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 440H, 1088 IA32_MC16_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 441H, 1089 IA32_MC16_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 442H, 1090 IA32_MC16_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 443H, 1091 IA32_MC16_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 444H, 1092 IA32_MC17_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 445H, 1093 IA32_MC17_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS," and Chapter 17. Package 
Register Address: 446H, 1094 IA32_MC17_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs."” Package 
Register Address: 447H, 1095 IA32_MC17_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 448H, 1096 IA32_MC18_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 449H, 1097 IA32_MC18_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,”" and Chapter 17. Package 
Register Address: 44AH, 1098 IA32_MC18_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 44BH, 1099 IA32_MC18_MISC 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Register Address: 44CH, 1100 IA32_MC19_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-23. Additional MSRs Supported by the Intel® Xeon® Processors E5 Family Based on Sandy Bridge 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 44DH, 1101 IA32_MC19_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS,” and Chapter 17. Package 
Register Address: 44EH, 1102 IA32_MC19_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Package 
Register Address: 44FH, 1103 IA32_MC19_ MISC 
See Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Register Address: 613H, 1555 MSR_PKG_PERF_STATUS 
Package RAPL Perf Status (R/O) Package 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 
DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains." 
See Table 2-20, Table 2-23, and Table 2-24 for MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_2DH. 


2.11.3 Additional Uncore PMU MSRs in the Intel® Xeon® Processor E5 Family 


Intel Xeon Processor E5 family is based on the Sandy Bridge microarchitecture. The MSR-based uncore PMU inter- 
faces are listed in Table 2-24. For complete details of the uncore PMU, refer to the Intel Xeon Processor E5 Product 
Family Uncore Performance Monitoring Guide. These processors have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_2DH. 


Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: CO8H, 3080 MSR_U_PMON_UCLK_FIXED_CTL 
Uncore U-box UCLK Fixed Counter Control Package 
Register Address: COSH, 3081 MSR_U_PMON_UCLK_FIXED_CTR 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore U-box UCLK Fixed Counter Package 
Register Address: C10H, 3088 MSR_U_PMON_EVNTSELO 
Uncore U-box Perfmon Event Select for U-box Counter 0 Package 
Register Address: C11H, 3089 MSR_U_PMON_EVNTSEL1 
Uncore U-box Perfmon Event Select for U-box Counter 1 Package 
Register Address: C16H, 3094 MSR_U_PMON_CTRO 
Uncore U-box Perfmon Counter 0 Package 
Register Address: C17H, 3095 MSR_U_PMON_CTR1 
Uncore U-box Perfmon Counter 1 Package 
Register Address: C24H, 3108 MSR_PCU_PMON_BOX_CTL 
Uncore PCU Perfmon for PCU-box-wide Control Package 
Register Address: C30H, 3120 MSR_PCU_PMON_EVNTSELO 
Uncore PCU Perfmon Event Select for PCU Counter 0 Package 
Register Address: C31H, 3121 MSR_PCU_PMON_EVNTSEL1 
Uncore PCU Perfmon Event Select for PCU Counter 1 Package 
Register Address: C32H, 3122 MSR_PCU_PMON_EVNTSEL2 
Uncore PCU Perfmon Event Select for PCU Counter 2 Package 
Register Address: C33H, 3123 MSR_PCU_PMON_EVNTSEL3 
Uncore PCU Perfmon Event Select for PCU Counter 3 Package 
Register Address: C34H, 3124 MSR_PCU_PMON_BOX_FILTER 
Uncore PCU Perfmon box-wide Filter Package 
Register Address: C36H, 3126 MSR_PCU_PMON_CTRO 
Uncore PCU Perfmon Counter O Package 
Register Address: C37H, 3127 MSR_PCU_PMON_CTR1 
Uncore PCU Perfmon Counter 1 Package 
Register Address: C38H, 3128 MSR_PCU_PMON_CTR2 
Uncore PCU Perfmon Counter 2 Package 
Register Address: C39H, 3129 MSR_PCU_PMON_CTR3 
Uncore PCU Perfmon Counter 3 Package 
Register Address: DO4H, 3332 MSR_CO_PMON_BOX_CTL 
Uncore C-box 0 Perfmon Local Box Wide Control Package 
Register Address: D10H, 3344 MSR_CO_PMON_EVNTSELO 
Uncore C-box 0 Perfmon Event Select for C-box O Counter 0 Package 
Register Address: D11H, 3345 MSR_CO_PMON_EVNTSEL1 
Uncore C-box 0 Perfmon Event Select for C-box O Counter 1 Package 
Register Address: D12H, 3346 MSR_CO_PMON_EVNTSEL2 
Uncore C-box 0 Perfmon Event Select for C-box O Counter 2 Package 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: D13H, 3347 MSR_CO_PMON_EVNTSEL3 
Uncore C-box 0 Perfmon Event Select for C-box O Counter 3 Package 
Register Address: D14H, 3348 MSR_CO_PMON_BOX_FILTER 
Uncore C-box 0 Perfmon Box Wide Filter Package 
Register Address: D16H, 3350 MSR_CO_PMON_CTRO 
Uncore C-box 0 Perfmon Counter O Package 
Register Address: D17H, 3351 MSR_CO_PMON_CTR1 
Uncore C-box 0 Perfmon Counter 1 Package 
Register Address: D18H, 3352 MSR_CO_PMON_CTR2 
Uncore C-box 0 Perfmon Counter 2 Package 
Register Address: D19H, 3353 MSR_CO_PMON_CTR3 
Uncore C-box 0 Perfmon Counter 3 Package 
Register Address: D24H, 3364 MSR_C1_PMON_BOX_CTL 
Uncore C-box 1 Perfmon Local Box Wide Control Package 
Register Address: D30H, 3376 MSR_C1_PMON_EVNTSELO 
Uncore C-box 1 Perfmon Event Select for C-box 1 Counter 0 Package 
Register Address: D31H, 3377 MSR_C1_PMON_EVNTSEL1 
Uncore C-box 1 Perfmon Event Select for C-box 1 Counter 1 Package 
Register Address: D32H, 3378 MSR_C1_PMON_EVNTSEL2 
Uncore C-box 1 Perfmon Event Select for C-box 1 Counter 2 Package 
Register Address: D33H, 3379 MSR_C1_PMON_EVNTSEL3 
Uncore C-box 1 Perfmon Event Select for C-box 1 Counter 3 Package 
Register Address: D34H, 3380 MSR_C1_PMON_BOX_FILTER 
Uncore C-box 1 Perfmon Box Wide Filter Package 
Register Address: D36H, 3382 MSR_C1_PMON_CTRO 
Uncore C-box 1 Perfmon Counter 0 Package 
Register Address: D37H, 3383 MSR_C1_PMON_CTR1 
Uncore C-box 1 Perfmon Counter 1 Package 
Register Address: D38H, 3384 MSR_C1_PMON_CTR2 
Uncore C-box 1 Perfmon Counter 2 Package 
Register Address: D39H, 3385 MSR_C1_PMON_CTR3 
Uncore C-box 1 Perfmon Counter 3 Package 
Register Address: D44H, 3396 MSR_C2_PMON_BOX_CTL 
Uncore C-box 2 Perfmon Local Box Wide Control Package 
Register Address: D50H, 3408 MSR_C2_PMON_EVNTSELO 
Uncore C-box 2 Perfmon Event Select for C-box 2 Counter 0 Package 
Register Address: D51H, 3409 MSR_C2_PMON_EVNTSEL1 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-box 2 Perfmon Event Select for C-box 2 Counter 1 Package 
Register Address: D52H, 3410 MSR_C2_PMON_EVNTSEL2 
Uncore C-box 2 Perfmon Event Select for C-box 2 Counter 2 Package 
Register Address: D53H, 3411 MSR_C2_PMON_EVNTSEL3 
Uncore C-box 2 Perfmon Event Select for C-box 2 Counter 3 Package 
Register Address: D54H, 3412 MSR_C2_PMON_BOX_FILTER 
Uncore C-box 2 Perfmon Box Wide Filter Package 
Register Address: D56H, 3414 MSR_C2_PMON_CTRO 
Uncore C-box 2 Perfmon Counter O Package 
Register Address: D57H, 3415 MSR_C2_PMON_CTR1 
Uncore C-box 2 Perfmon Counter 1 Package 
Register Address: D58H, 3416 MSR_C2_PMON_CTR2 
Uncore C-box 2 Perfmon Counter 2 Package 
Register Address: D59H, 3417 MSR_C2_PMON_CTR3 
Uncore C-box 2 Perfmon Counter 3 Package 
Register Address: D64H, 3428 MSR_C3_PMON_BOX_CTL 
Uncore C-box 3 Perfmon Local Box Wide Control Package 
Register Address: D70H, 3440 MSR_C3_PMON_EVNTSELO 
Uncore C-box 3 Perfmon Event Select for C-box 3 Counter O Package 
Register Address: D71H, 3441 MSR_C3_PMON_EVNTSEL1 
Uncore C-box 3 Perfmon Event Select for C-box 3 Counter 1 Package 
Register Address: D72H, 3442 MSR_C3_PMON_EVNTSEL2 
Uncore C-box 3 Perfmon Event Select for C-box 3 Counter 2 Package 
Register Address: D73H, 3443 MSR_C3_PMON_EVNTSEL3 
Uncore C-box 3 Perfmon Event Select for C-box 3 Counter 3 Package 
Register Address: D74H, 3444 MSR_C3_PMON_BOX_FILTER 
Uncore C-box 3 Perfmon Box Wide Filter Package 
Register Address: D76H, 3446 MSR_C3_PMON_CTRO 
Uncore C-box 3 Perfmon Counter O Package 
Register Address: D77H, 3447 MSR_C3_PMON_CTR1 
Uncore C-box 3 Perfmon Counter 1 Package 
Register Address: D78H, 3448 MSR_C3_PMON_CTR2 
Uncore C-box 3 Perfmon Counter 2 Package 
Register Address: D79H, 3449 MSR_C3_PMON_CTR3 
Uncore C-box 3 Perfmon Counter 3 Package 
Register Address: D84H, 3460 MSR_C4_PMON_BOX_CTL 
Uncore C-box 4 Perfmon Local Box Wide Control Package 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: D9OH, 3472 MSR_C4_PMON_EVNTSELO 
Uncore C-box 4 Perfmon Event Select for C-box 4 Counter 0 Package 
Register Address: D91H, 3473 MSR_C4_PMON_EVNTSEL1 
Uncore C-box 4 Perfmon Event Select for C-box 4 Counter 1 Package 
Register Address: D92H, 3474 MSR_C4_PMON_EVNTSEL2 
Uncore C-box 4 Perfmon Event Select for C-box 4 Counter 2 Package 
Register Address: D93H, 3475 MSR_C4_PMON_EVNTSEL3 
Uncore C-box 4 Perfmon Event Select for C-box 4 Counter 3 Package 
Register Address: D94H, 3476 MSR_C4_PMON_BOX_FILTER 
Uncore C-box 4 Perfmon Box Wide Filter Package 
Register Address: D9GH, 3478 MSR_C4_PMON_CTRO 
Uncore C-box 4 Perfmon Counter 0 Package 
Register Address: D97H, 3479 MSR_C4_PMON_CTR1 
Uncore C-box 4 Perfmon Counter 1 Package 
Register Address: D98H, 3480 MSR_C4_PMON_CTR2 
Uncore C-box 4 Perfmon Counter 2 Package 
Register Address: D99H, 3481 MSR_C4_PMON_CTR3 
Uncore C-box 4 Perfmon Counter 3 Package 
Register Address: DA4H, 3492 MSR_C5_PMON_BOX_CTL 
Uncore C-box 5 Perfmon Local Box Wide Control Package 
Register Address: DBOH, 3504 MSR_C5_PMON_EVNTSELO 
Uncore C-box 5 Perfmon Event Select for C-box 5 Counter 0 Package 
Register Address: DB1H, 3505 MSR_C5_PMON_EVNTSEL1 
Uncore C-box 5 Perfmon Event Select for C-box 5 Counter 1 Package 
Register Address: DB2H, 3506 MSR_C5_PMON_EVNTSEL2 
Uncore C-box 5 Perfmon Event Select for C-box 5 Counter 2 Package 
Register Address: DB3H, 3507 MSR_C5_PMON_EVNTSEL3 
Uncore C-box 5 Perfmon Event Select for C-box 5 Counter 3 Package 
Register Address: DB4H, 3508 MSR_C5_PMON_BOX_FILTER 
Uncore C-box 5 Perfmon Box Wide Filter Package 
Register Address: DB6H, 3510 MSR_C5_PMON_CTRO 
Uncore C-box 5 Perfmon Counter 0 Package 
Register Address: DB7H, 3511 MSR_C5_PMON_CTR1 
Uncore C-box 5 Perfmon Counter 1 Package 
Register Address: DB8H, 3512 MSR_C5_PMON_CTR2 
Uncore C-box 5 Perfmon Counter 2 Package 
Register Address: DB9H, 3513 MSR_C5_PMON_CTR3 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-box 5 Perfmon Counter 3 Package 
Register Address: DC4H, 3524 MSR_C6_PMON_BOX_CTL 
Uncore C-box 6 Perfmon Local Box Wide Control Package 
Register Address: DDOH, 3536 MSR_C6_PMON_EVNTSELO 
Uncore C-box 6 Perfmon Event Select for C-box 6 Counter O Package 
Register Address: DD1H, 3537 MSR_C6_PMON_EVNTSEL1 
Uncore C-box 6 Perfmon Event Select for C-box 6 Counter 1 Package 
Register Address: DD2H, 3538 MSR_C6_PMON_EVNTSEL2 
Uncore C-box 6 Perfmon Event Select for C-box 6 Counter 2 Package 
Register Address: DD3H, 3539 MSR_C6_PMON_EVNTSEL3 
Uncore C-box 6 Perfmon Event Select for C-box 6 Counter 3 Package 
Register Address: DD4H, 3540 MSR_C6_PMON_BOX_FILTER 
Uncore C-box 6 Perfmon Box Wide Filter Package 
Register Address: DD6H, 3542 MSR_C6_PMON_CTRO 
Uncore C-box 6 Perfmon Counter O Package 
Register Address: DD7H, 3543 MSR_C6_PMON_CTR1 
Uncore C-box 6 Perfmon Counter 1 Package 
Register Address: DD8H, 3544 MSR_C6_PMON_CTR2 
Uncore C-box 6 Perfmon Counter 2 Package 
Register Address: DDSH, 3545 MSR_C6_PMON_CTR3 
Uncore C-box 6 Perfmon Counter 3 Package 
Register Address: DE4H, 3556 MSR_C7_PMON_BOX_CTL 
Uncore C-box 7 Perfmon Local Box Wide Control Package 
Register Address: DFOH, 3568 MSR_C7_PMON_EVNTSELO 
Uncore C-box 7 Perfmon Event Select for C-box 7 Counter O Package 
Register Address: DF1H, 3569 MSR_C7_PMON_EVNTSEL1 
Uncore C-box 7 Perfmon Event Select for C-box 7 Counter 1 Package 
Register Address: DF2H, 3570 MSR_C7_PMON_EVNTSEL2 
Uncore C-box 7 Perfmon Event Select for C-box 7 Counter 2 Package 
Register Address: DF3H, 3571 MSR_C7_PMON_EVNTSEL3 
Uncore C-box 7 Perfmon Event Select for C-box 7 Counter 3 Package 
Register Address: DF4H, 3572 MSR_C7_PMON_BOX_FILTER 
Uncore C-box 7 Perfmon Box Wide Filter Package 
Register Address: DF6H, 3574 MSR_C7_PMON_CTRO 
Uncore C-box 7 Perfmon Counter O Package 
Register Address: DF7H, 3575 MSR_C7_PMON_CTR1 
Uncore C-box 7 Perfmon Counter 1 Package 
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Table 2-24. Uncore PMU MSRs in Intel® Xeon® Processor E5 Family (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: DF8H, 3576 MSR_C7_PMON_CTR2 
Uncore C-box 7 Perfmon Counter 2 Package 
Register Address: DF9H, 3577 MSR_C7_PMON_CTR3 
Uncore C-box 7 Perfmon Counter 3 Package 


2.12 MSRSIN THE 3RD GENERATION INTEL® CORE™ PROCESSOR FAMILY BASED 
ON IVY BRIDGE MICROARCHITECTURE 


The 3rd generation Intel® Core™ processor family and the Intel® Xeon® processor E3-1200v2 product family 
based on Ivy Bridge microarchitecture support the MSR interfaces listed in Table 2-20, Table 2-21, Table 2-22, and 
Table 2-25. These processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_3AH. 


Table 2-25. Additional MSRs Supported by 3rd Generation Intel® Core™ Processors Based on Ivy Bridge 
Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 


This is the ratio of the frequency that invariant TSC runs at. Frequency = 
ratio * 100 MHz. 

27:16 Reserved. 

28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to 0, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 

29 Programmable TDP Limit for Turbo Mode (R/O) Package 


When set to 1, indicates that TDP Limit for Turbo mode is programmable. 
When set to 0, indicates that TDP Limit for Turbo mode is not 
programmable. 


31:30 Reserved. 


32 Low Power Mode Support (LPM) (R/O) Package 
When set to 1, indicates that LPM is supported. When set to O, indicates 
LPM is not supported. 

34:33 Number of ConfigTDP Levels (R/O) Package 
00: Only Base TDP level available. 

01: One additional TDP level available. 
02: Two additional TDP level available. 
03: Reserved 


39:35 Reserved. 
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Table 2-25. Additional MSRs Supported by 3rd Generation Intel® Core™ Processors Based on Ivy Bridge 


Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 100MHz. 

55:48 Minimum Operating Ratio (R/O) Package 
Contains the minimum supported operating ratio in units of 100 MHz. 

63:56 Reserved. 

Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 


Note: C-state values are processor specific C-state code names, unrelated 
to MWAIT extension C-state parameters or ACPI C-States. 


See http://biosbits.org. 


2:0 


Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 


The following C-state code name encodings are supported: 
000b: CO/C1 (no package C-sate support) 

001b: C2 

010b: C6 no retention 

011b: C6 retention 

100b: C7 

101b: C7s 

111: No package C-state limit. 

Note: This field cannot be used to limit package C-state to C3. 


9:3 


Reserved. 


10 


I/O MWAIT Redirection Enable (R/W) 


When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 


14:11 


Reserved. 


15 


CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 


24:16 


Reserved 


25 


C3 State Auto Demotion Enable (R/W) 


When set, the processor will conditionally demote C6/C7 requests to C3 
based on uncore auto-demote information. 


26 


C1 State Auto Demotion Enable (R/W) 


When set, the processor will conditionally demote C3/C6/C7 requests to 
C1 based on uncore auto-demote information. 


27 


Enable C3 Undemotion (R/W) 
When set, enables undemotion from demoted C3. 
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Table 2-25. Additional MSRs Supported by 3rd Generation Intel® Core™ Processors Based on Ivy Bridge 


Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
28 Enable C1 Undemotion (R/W) 
When set, enables undemotion from demoted C1. 
63:29 Reserved. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 648H, 1608 MSR_CONFIG_TDP_NOMINAL 
Base TDP Ratio (R/O) Package 
7:0 Config_TDP_Base 
Base TDP level ratio to be used for this specific processor (in units of 100 
MHz). 
63:8 Reserved. 
Register Address: 649H, 1609 MSR_CONFIG_TDP_LEVEL1 
ConfigTDP Level 1 ratio and power level (R/O) Package 
140 PKG_TDP_LVL1 
Power setting for ConfigTDP Level 1. 
15 Reserved. 
23:16 Config_TDP_LVL1_Ratio 
ConfigTDP level 1 ratio to be used for this specific processor. 
31:24 Reserved. 
46:32 PKG_MAX_PWR_LVL1 
Max Power setting allowed for ConfigTDP Level 1. 
47 Reserved. 
62:48 PKG_MIN_PWR_LVL1 
MIN Power setting allowed for ConfigTDP Level 1. 
63 Reserved. 
Register Address: 64AH, 1610 MSR_CONFIG_TDP_LEVEL2 
ConfigTDP Level 2 ratio and power level (R/O) Package 


14:0 PKG_TDP_LVL2 
Power setting for ConfigTDP Level 2. 
15 Reserved. 
23:16 Config_TDP_LVL2_Ratio 
ConfigTDP level 2 ratio to be used for this specific processor. 
31:24 Reserved. 
46:32 PKG_MAX_PWR_LVL2 
Max Power setting allowed for ConfigTDP Level 2. 
47 Reserved. 
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Table 2-25. Additional MSRs Supported by 3rd Generation Intel® Core™ Processors Based on Ivy Bridge 


Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
62:48 PKG_MIN_PWR_LVL2 
MIN Power setting allowed for ConfigTDP Level 2. 
63 Reserved. 
Register Address: 64BH, 1611 MSR_CONFIG_TDP_CONTROL 
ConfigTDP Control (R/W) Package 
1:0 TDP_LEVEL (RW/L) 
System BIOS can program this field. 
30:2 Reserved. 
31 Config_TDP_Lock (RW/L) 
When this bit is set, the content of this register is locked until a reset. 
63:32 Reserved. 
Register Address: 64CH, 1612 MSR_TURBO_ACTIVATION_RATIO 
ConfigTDP Control (R/W) Package 
7:0 MAX_NON_TURBO_RATIO (RW/L) 
System BIOS can program this field. 
30:8 Reserved. 
31 TURBO_ACTIVATION_RATIO_Lock (RW/L) 
When this bit is set, the content of this register is locked until a reset. 
63:32 Reserved. 


See Table 2-20, Table 2-21, and Table 2-22 for other MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_3AH. 


2.12.1 MSRs in the Intel® Xeon® Processor E5 v2 Product Family Based on Ivy Bridge-E 


Microarchitecture 


Table 2-26 lists model-specific registers (MSRs) that are specific to the Intel® Xeon® Processor E5 v2 Product 
Family (based on Ivy Bridge-E microarchitecture). These processors have a CPUID Signature 


DisplayFamily_DisplayModel value of 06_3EH; see Table 2-1. These processors supports the MSR interfaces listed 


in Table 2-20 and Table 2-26. 


Table 2-26. MSRs Supported by the Intel® Xeon® Processor €5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 4EH, 78 IA32_PPIN_CTL (MSR_PPIN_CTL) 
Protected Processor Inventory Number Enable Control (R/W) Package 


0 


63:2 


LockOut (R/WO) 
See Table 2-2. 


Enable_PPIN (R/W) 
See Table 2-2. 


Reserved. 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor E5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 4FH, 79 IA32_PPIN (MSR_PPIN) 

Protected Processor Inventory Number (R/O) Package 

63:0 Protected Processor Inventory Number (R/O) 
See Table 2-2. 

Register Address: CEH, 206 MSR_PLATFORM_INFO 

Platform Information Package 

Contains power management and other model specific features enumeration. See http://biosbits.org. 

7:0 Reserved. 

15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the frequency that invariant TSC runs at. Frequency = 
ratio * 100 MHz. 

22:16 Reserved. 

23 PPIN_CAP (R/O) Package 
When set to 1, indicates that Protected Processor Inventory Number (PPIN) 
capability can be enabled for a privileged system inventory agent to read 
PPIN from MSR_PPIN. 
When set to 0, PPIN capability is not supported. An attempt to access 
MSR_PPIN_CTL or MSR_PPIN will cause #GP. 

27:24 Reserved. 

28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to 0, indicates Programmable Ratio Limit for Turbo mode 
is disabled. 

29 Programmable TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDP Limit for Turbo mode is programmable. 
When set to 0, indicates TDP Limit for Turbo mode is not programmable. 

30 Programmable T] OFFSET (R/O) Package 
When set to 1, indicates that MSR_TEMPERATURE_TARGET.[27:24] is valid 
and writable to specify a temperature offset. 

39:31 Reserved. 

47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 1OOMHz. 

63:48 Reserved. 

Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 

C-State Configuration Control (R/W) Core 

Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 

ACPI C-states. See http://biosbits.org. 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor €5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


2:0 Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 


The following C-state code name encodings are supported: 
000b: CO/C1 (no package C-sate support) 

001b: C2 

010b: C6 no retention 

011b: C6 retention 

100b: C7 

101b: C7s 

111: No package C-state limit. 

Note: This field cannot be used to limit package C-state to C3. 


9:3 Reserved. 


10 I/O MWAIT Redirection Enable (R/W) 


When set, will map IO_read instructions sent to IO register specified by 
MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions. 


14:11 Reserved. 
15 CFG Lock (R/WO) 
When set, locks bits 15:0 of this register until next reset. 
63:16 Reserved. 
Register Address: 179H, 377 IA32_MCG_CAP 
Global Machine Check Capability (R/O) Thread 
7:0 Count 
8 MCG_CTL_P 
9 MCG_EXT_P 
10 MCP_CMCI_P 
11 MCG_TES_P 
15:12 Reserved. 
23:16 MCG_EXT_CNT 
24 MCG_SER_P 
25 Reserved. 
26 MCG_ELOG_P 
63:27 Reserved. 
Register Address: 17FH, 383 MSR_ERROR_CONTROL 
MC Bank Error Configuration (R/W) Package 
0 Reserved. 
1 MemeError Log Enable (R/W) 
When set, enables IMC status bank to log additional info in bits 36:32. 
63:2 Reserved. 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor E5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Package 
15:0 Reserved. 
23:16 Temperature Target (R/O) 
The minimum temperature at which PROCHOT# will be asserted. The value 
is degrees C. 
27:24 TCC Activation Offset (R/W) 
Specifies a temperature offset in degrees C from the temperature target 
(bits 23:16), PROCHOT# will assert at the offset target temperature. Write 
is permitted only if MSR_PLATFORM_INFO.[30] is set. 
63:28 Reserved. 
Register Address: 1 AEH, 430 MSR_TURBO_RATIO_LIMIT1 
Maximum Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0. R/W if MSR_PLATFORM_INFO.[28] = 1. 
7:0 Maximum Ratio Limit for 9C Package 
Maximum turbo ratio limit of 9 core active. 
15:8 Maximum Ratio Limit for 10C Package 
Maximum turbo ratio limit of 10 core active. 
23:16 Maximum Ratio Limit for 11C Package 
Maximum turbo ratio limit of 11 core active. 
31:24 Maximum Ratio Limit for 12C Package 
Maximum turbo ratio limit of 12 core active. 
63:32 Reserved. 
Register Address: 285H, 645 IA32_MC5_CTL2 
See Table 2-2. Package 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 
See Table 2-2. Package 
Register Address: 288H, 648 IA32_MC8_CTL2 
See Table 2-2. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 
See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 
See Table 2-2. Package 
Register Address: 28BH, 651 IA32_MC11_CTL2 
See Table 2-2. Package 
Register Address: 28CH, 652 IA32_MC12_CTL2 
See Table 2-2. Package 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor E5 v2 Product Family (Ivy Bridge-E Microarchitecture) 
Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 28DH, 653 IA32_MC13_CTL2 
See Table 2-2. Package 
Register Address: 28H, 654 IA32_MC14_CTL2 
See Table 2-2. Package 
Register Address: 28FH, 655 IA32_MC15_CTL2 
See Table 2-2. Package 
Register Address: 290H, 656 IA32_MC16_CTL2 
See Table 2-2. Package 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 294H, 660 IA32_MC20_CTL2 
See Table 2-2. Package 
Register Address: 295H, 661 IA32_MC21_CTL2 
See Table 2-2. Package 
Register Address: 296H, 662 IA32_MC22_CTL2 
See Table 2-2. Package 


Register Address: 297H, 663 


IA32_MC23_CTL2ZIA32_MC23_CTL2 


Bank MC5 reports MC errors from the Intel QPI module. 


See Table 2-2. Package 
Register Address: 298H, 664 IA32_MC24_CTL2 

See Table 2-2. Package 
Register Address: 299H, 665 IA32_MC25_CTL2 

See Table 2-2. Package 
Register Address: 29AH, 666 IA32_MC26_CTL2 

See Table 2-2. Package 
Register Address: 29BH, 667 IA32_MC27_CTL2 

See Table 2-2. Package 
Register Address: 29CH, 668 IA32_MC28_CTL2 

See Table 2-2. Package 
Register Address: 414H, 1044 IA32_MC5_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
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Register Address: 415H, 1045 IA32_MC5_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC5 reports MC errors from the Intel QPI module. 


Package 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor E5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 416H, 1046 


IA32_MC5_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Bank MC5 reports MC errors from the Intel QPI module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 417H, 1047 


IA32_MC5_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Bank MC5 reports MC errors from the Intel QPI module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 418H, 1048 


IA32_MC6_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC6 reports MC errors from the int 


Rs,” through Section 16.3.2.4, 
egrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 419H, 1049 


IA32_MC6_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC6 reports MC errors from the int 


Rs,” through Section 16.3.2.4, 
egrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41AH, 1050 


IA32_MC6_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC6 reports MC errors from the int 


Rs,” through Section 16.3.2.4, 
egrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41BH, 1051 


1A32_MC6_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC6 reports MC errors from the int 


Rs,” through Section 16.3.2.4, 
egrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41CH, 1052 


IA32_MC7_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41DH, 1053 


IA32_MC7_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41€H, 1054 


IA32_MC7_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41FH, 1055 


IA32_MC7_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 420H, 1056 


IA32_MC8_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 421H, 1057 


IA32_MC8_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 422H, 1058 
See Section 16.3.2.1, “IA32_MCi_CTL MS 


IA32_MC8_ADDR 
Rs,” through Section 16.3.2.4, 


Banks MC7 and MC 8 report MC errors from the two home agents. 


“IA32_MCi_MISC MSRs.” 


Package 
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Table 2-26. MSRs Supported by the Intel® Xeon® Processor E5 v2 Product Family (Ivy Bridge-E Microarchitecture) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


Register Address: 423H, 1059 IA32_MC8_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC7 and MC 8 report MC errors from the two home agents. 


Register Address: 424H, 1060 IA32_MC9_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 425H, 1061 IA32_MC9_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 426H, 1062 IA32_MC9_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 427H, 1063 IA32_MC9_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 428H, 1064 IA32_MC10_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 429H, 1065 IA32_MC10_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42AH, 1066 IA32_MC10_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42BH, 1067 IA32_MC10_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42CH, 1068 IA32_MC11_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Bank MC11 reports MC errors from a specific channel of the integrated memory controller. 


Register Address: 42DH, 1069 IA32_MC11_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Bank MC11 reports MC errors from a specific channel of the integrated memory controller. 


Register Address: 42EH, 1070 IA32_MC11_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Bank MC11 reports MC errors from a specific channel of the integrated memory controller. 


Register Address: 42FH, 1071 IA32_MC11_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Bank MC11 reports MC errors from a specific channel of the integrated memory controller. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description 


Scope 


Register Address: 430H, 1072 IA32_MC12_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 431H, 1073 IA32_MC12_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 432H, 1074 IA32_MC12_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 433H, 1075 IA32_MC12_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 434H, 1076 IA32_MC13_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,”" through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 435H, 1077 IA32_MC13_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 436H, 1078 IA32_MC13_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 437H, 1079 IA32_MC13_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 438H, 1080 IA32_MC14_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 439H, 1081 IA32_MC14_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 43AH, 1082 


IA32_MC14_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 43BH, 1083 


IA32_MC14_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 43CH, 1084 
See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


IA32_MC15_CTL 
Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


Register Address: 43DH, 1085 IA32_MC15_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43EH, 1086 IA32_MC15_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43FH, 1087 IA32_MC15_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 440H, 1088 IA32_MC16_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 441H, 1089 IA32_MC16_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 442H, 1090 IA32_MC16_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 443H, 1091 IA32_MC16_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 444H, 1092 IA32_MC17_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC17 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Register Address: 445H, 1093 IA32_MC17_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC17 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Register Address: 446H, 1094 IA32_MC17_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC17 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Register Address: 447H, 1095 IA32_MC17_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC17 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Register Address: 448H, 1096 IA32_MC18_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC18 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Register Address: 449H, 1097 IA32_MC18_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC18 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 44AH, 1098 


IA32_MC18_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC18 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 44BH, 1099 


IA32_MC18_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC18 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 44CH, 1100 


IA32_MC19_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC19 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 44DH, 1101 


IA32_MC19_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC19 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 44EH, 1102 


IA32_MC19_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC19 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 44FH, 1103 


IA32_MC19_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC19 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 450H, 1104 


IA32_MC20_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC20 reports MC errors from a spe 


Rs." 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 451H, 1105 


IA32_MC20_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC20 reports MC errors from a spe 


Rs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 452H, 1106 


IA32_MC20_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC20 reports MC errors from a spe 


Rs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 453H, 1107 


IA32_MC20_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC20 reports MC errors from a spe 


Rs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 454H, 1108 


IA32_MC21_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC21 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 455H, 1109 


IA32_MC21_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC21 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 456H, 1110 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC21 reports MC errors from a spe 


IA32_MC21_ADDR 
Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 457H, 1111 


IA32_MC21_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC21 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 458H, 1112 


IA32_MC22_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC22 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 459H, 1113 


IA32_MC22_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC22 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45AH, 1114 


IA32_MC22_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC22 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45BH, 1115 


IA32_MC22_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC22 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45CH, 1116 


IA32_MC23_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC23 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45DH, 1117 


IA32_MC23_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC23 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45E€H, 1118 


IA32_MC23_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC23 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 45FH, 1119 


IA32_MC23_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC23 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 460H, 1120 


IA32_MC24_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC24 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 461H, 1121 


IA32_MC24_ STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC24 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 462H, 1122 


IA32_MC24_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC24 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 463H, 1123 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC24 reports MC errors from a spe 
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Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 464H, 1124 


IA32_MC25_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC25 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 465H, 1125 


IA32_MC25_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC25 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 466H, 1126 


IA32_MC25_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC25 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 467H, 1127 


IA32_MC2MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC25 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 468H, 1128 


IA32_MC26_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC26 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 469H, 1129 


IA32_MC26_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC26 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 46AH, 1130 


IA32_MC26_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC26 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 46BH, 1131 


IA32_MC26_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC26 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 46CH, 1132 


IA32_MC27_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Bank MC27 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 46DH, 1133 


IA32_MC27_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC27 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 46EH, 1134 


IA32_MC27_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC27 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 46FH, 1135 


IA32_MC27_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC27 reports MC errors from a spe 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 


Register Address: 470H, 1136 


See Section 16.3.2.1, “IA32_MCi_CTL MS 
Bank MC28 reports MC errors from a spe 


IA32_MC28_CTL 
Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


cific CBo (core broadcast) and its corresponding slice of L3. 


Package 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


See Section 15.10.4, “PPO/PP1 RAPL Domains." 


See Table 2-20, for other MSR definitions applicable to Intel Xeon processor E5 v2 with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_3EH. 


Register Information / Bit Fields Bit Description Scope 
Register Address: 471H, 1137 IA32_MC28_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC28 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 472H, 1138 IA32_MC28_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC28 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 473H, 1139 IA32_MC28_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC28 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 613H, 1555 MSR_PKG_PERF_STATUS 
Package RAPL Perf Status (R/O) Package 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 
DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 


2.12.2 Additional MSRs Supported by the Intel® Xeon® Processor E7 v2 Family 


The Intel® Xeon® processor E7 v2 family (based on Ivy Bridge-E microarchitecture) with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_3EH supports the MSR interfaces listed in Table 2-20, Table 2-26, and 


Table 2-27. 


Table 2-27. Additional MSRs Supported by the Intel® Xeon® Processor E7 v2 Family with a CPUID Signature 


Di 


splayFamily_DisplayModel Value of 06_3EH 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 3AH, 58 


IA32_FEATURE_CONTROL 
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Table 2-27. Additional MSRs Supported by the Intel® Xeon® Processor E7 v2 Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of O06_3EH (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Control Features in Intel 64 Processor (R/W) Thread 
See Table 2-2. 

0 Lock (R/WL) 

1 Enable VMX Inside SMX Operation (R/WL) 

2 Enable VMX Outside SMX Operation (R/WL) 

14:8 SENTER Local Functions Enables (R/WL) 

15 SENTER Global Functions Enable (R/WL) 

63:16 Reserved. 

Register Address: 1 79H, 377 IA32_MCG_CAP 

Global Machine Check Capability (R/O) Thread 

7:0 Count 

8 MCG_CTL_P 

9 MCG_EXT_P 

10 MCP_CMCI_P 

11 MCG_TES_P 

15:12 Reserved. 

23:16 MCG_EXT_CNT 

24 MCG_SER_P 

63:25 Reserved. 

Register Address: 17AH, 378 IA32_MCG_STATUS 

Global Machine Check Status (R/W) Thread 

0 RIPV 

1 EIPV 

2 MCIP 

3 LMCE Signaled 

63:4 Reserved. 

Register Address: 1 AEH, 430 MSR_TURBO_RATIO_LIMIT1 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 

7:0 Maximum Ratio Limit for 9C Package 
Maximum turbo ratio limit of 9 core active. 

15:8 Maximum Ratio Limit for 10C Package 
Maximum turbo ratio limit of 1Ocore active. 

23:16 Maximum Ratio Limit for 11C Package 
Maximum turbo ratio limit of 11 core active. 

31:24 Maximum Ratio Limit for 12C Package 
Maximum turbo ratio limit of 12 core active. 
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Table 2-27. Additional MSRs Supported by the Intel® Xeon® Processor E7 v2 Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of O06_3EH (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
39:32 Maximum Ratio Limit for 13C Package 
Maximum turbo ratio limit of 13 core active. 

47:40 Maximum Ratio Limit for 14C Package 
Maximum turbo ratio limit of 14 core active. 

55:48 Maximum Ratio Limit for 15C Package 
Maximum turbo ratio limit of 15 core active. 

62:56 Reserved. 

63 Semaphore for Turbo Ratio Limit Configuration Package 
If 1, the processor uses override configuration’ specified in 
MSR_TURBO_RATIO_LIMIT and MSR_TURBO_RATIO_LIMIT1. 
If O, the processor uses factory-set configuration (Default). 

Register Address: 29DH, 669 IA32_MC29_CTL2 

See Table 2-2. Package 

Register Address: 29€H, 670 IA32_MC30_CTL2 

See Table 2-2. Package 

Register Address: 29FH, 671 IA32_MC31_CTL2 

See Table 2-2. Package 

Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 

See Section 20.3.1.1.1, “Processor Event Based Sampling (PEBS).” Thread 

n0 Enable PEBS on IA32_PMCx. (R/W) 

31:n+1 Reserved. 

32+m:32 Enable Load Latency on IA32_PMCx. (R/W) 

63:33+m Reserved. 

Register Address: 41BH, 1051 IA32_MC6_MISC 

Misc MAC Information of Integrated I/O (R/O) Package 

See Section 16.3.2.4. 

5:0 Recoverable Address LSB 

8:6 Address Mode 

15:9 Reserved. 

31:16 PCI Express Requestor ID 

39:32 PCI Express Segment Number 

63:32 Reserved. 

Register Address: 474H, 1140 IA32_MC29_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC29 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 

Register Address: 475H, 1141 IA32_MC29_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC29 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
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Table 2-27. Additional MSRs Supported by the Intel® Xeon® Processor E7 v2 Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of O06_3EH (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 476H, 1142 IA32_MC29_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC29 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 477H, 1143 IA32_MC29_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC29 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 478H, 1144 IA32_MC30_CTL 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC30 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 479H, 1145 IA32_MC30_STATUS 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC30 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47AH, 1146 IA32_MC30_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC30 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47BH, 1147 IA32_MC30_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC30 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47CH, 1148 IA32_MC31_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC31 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47DH, 1149 IA32_MC31_STATUS 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC31 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47EH, 1150 IA32_MC31_ADDR 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC31 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 
Register Address: 47FH, 1147 IA32_MC31_MISC 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC31 reports MC errors from a specific CBo (core broadcast) and its corresponding slice of L3. 


See Table 2-20, Table 2-26 for other MSR definitions applicable to Intel Xeon processor E7 v2 with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_3AH. 


NOTES: 


1. An override configuration lower than the factory-set configuration is always supported. An override configuration higher than the 
factory-set configuration is dependent on features specific to the processor and the platform. 


2.12.3. Additional Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families 


Intel Xeon Processor E5 v2 and E7 v2 families are based on the Ivy Bridge-E microarchitecture. The MSR-based 
uncore PMU interfaces are listed in Table 2-24 and Table 2-28. For complete detail of the uncore PMU, refer to Intel 
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Xeon Processor E5 v2 Product Family Uncore Performance Monitoring Guide. These processors have a CPUID 
Signature DisplayFamily_DisplayModel value of 06_3EH. 


Table 2-28. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: COOH, 3072 MSR_PMON_GLOBAL_CTL 
Uncore Perfmon Per-Socket Global Control Package 
Register Address: CO1H, 3073 MSR_PMON_GLOBAL_STATUS 
Uncore Perfmon Per-Socket Global Status Package 
Register Address: CO6H, 3078 MSR_PMON_GLOBAL_CONFIG 
Uncore Perfmon Per-Socket Global Configuration Package 
Register Address: C15H, 3093 MSR_U_PMON_BOX_STATUS 
Uncore U-box Perfmon U-Box Wide Status Package 
Register Address: C35H, 3125 MSR_PCU_PMON_BOX_STATUS 
Uncore PCU Perfmon Box Wide Status Package 
Register Address: D1AH, 3354 MSR_CO_PMON_BOX_FILTER1 
Uncore C-Box 0 Perfmon Box Wide Filter1 Package 
Register Address: D3AH, 3386 MSR_C1_PMON_BOX_FILTER1 
Uncore C-Box 1 Perfmon Box Wide Filter1 Package 
Register Address: D5AH, 3418 MSR_C2_PMON_BOX_FILTER1 
Uncore C-Box 2 Perfmon Box Wide Filter1 Package 
Register Address: D7AH, 3450 MSR_C3_PMON_BOX_FILTER1 
Uncore C-Box 3 Perfmon Box Wide Filter1 Package 
Register Address: D9AH, 3482 MSR_C4_PMON_BOX_FILTER1 
Uncore C-Box 4 Perfmon Box Wide Filter1 Package 
Register Address: DBAH, 3514 MSR_C5_PMON_BOX_FILTER1 
Uncore C-Box 5 Perfmon Box Wide Filter1 Package 
Register Address: DDAH, 3546 MSR_C6_PMON_BOX_FILTER1 
Uncore C-Box 6 Perfmon Box Wide Filter1 Package 
Register Address: DFAH, 3578 MSR_C7_PMON_BOX_FILTER1 
Uncore C-Box 7 Perfmon Box Wide Filter1 Package 
Register Address: E04H, 3588 MSR_C8_PMON_BOX_CTL 
Uncore C-Box 8 Perfmon Local Box Wide Control Package 
Register Address: 10H, 3600 MSR_C8_PMON_EVNTSELO 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 0 Package 
Register Address: 11H, 3601 MSR_C8_PMON_EVNTSEL1 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 1 Package 
Register Address: E12H, 3602 MSR_C8_PMON_EVNTSEL2 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 2 Package 


Register Address: E13H, 3603 


MSR_C8_PMON_EVNTSEL3 
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Table 2-28. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 3 Package 
Register Address: 14H, 3604 MSR_C8_PMON_BOX_FILTER 
Uncore C-Box 8 Perfmon Box Wide Filter Package 
Register Address: €16H, 3606 MSR_C8_PMON_CTRO 
Uncore C-Box 8 Perfmon Counter O Package 
Register Address: 17H, 3607 MSR_C8_PMON_CTR1 
Uncore C-Box 8 Perfmon Counter 1 Package 
Register Address: €18H, 3608 MSR_C8_PMON_CTR2 
Uncore C-Box 8 Perfmon Counter 2 Package 
Register Address: 19H, 3609 MSR_C8_PMON_CTR3 
Uncore C-Box 8 Perfmon Counter 3 Package 
Register Address: €1AH, 3610 MSR_C8_PMON_BOX_FILTER1 
Uncore C-Box 8 Perfmon Box Wide Filter1 Package 
Register Address: E24H, 3620 MSR_C9_PMON_BOX_CTL 
Uncore C-Box 9 Perfmon Local Box Wide Control Package 
Register Address: E30H, 3632 MSR_C9_PMON_EVNTSELO 
Uncore C-Box 9 Perfmon Event Select for C-box 9 Counter O Package 
Register Address: €31H, 3633 MSR_C9_PMON_EVNTSEL1 
Uncore C-Box 9 Perfmon Event Select for C-box 9 Counter 1 Package 
Register Address: 32H, 3634 MSR_C9_PMON_EVNTSEL2 
Uncore C-Box 9 Perfmon Event Select for C-box 9 Counter 2 Package 
Register Address: €33H, 3635 MSR_C9_PMON_EVNTSEL3 
Uncore C-Box 9 Perfmon Event Select for C-box 9 Counter 3 Package 
Register Address: E34H, 3636 MSR_C9_PMON_BOX_FILTER 
Uncore C-Box 9 Perfmon Box Wide Filter Package 
Register Address: 36H, 3638 MSR_C9_PMON_CTRO 
Uncore C-Box 9 Perfmon Counter O Package 
Register Address: 37H, 3639 MSR_C9_PMON_CTR1 
Uncore C-Box 9 Perfmon Counter 1 Package 
Register Address: 38H, 3640 MSR_C9_PMON_CTR2 
Uncore C-Box 9 Perfmon Counter 2 Package 
Register Address: €39H, 3641 MSR_C9_PMON_CTR3 
Uncore C-Box 9 Perfmon Counter 3 Package 
Register Address: E3AH, 3642 MSR_C9_PMON_BOX_FILTER1 
Uncore C-Box 9 Perfmon Box Wide Filter1 Package 
Register Address: E44H, 3652 MSR_C10_PMON_BOX_CTL 
Uncore C-Box 10 Perfmon Local Box Wide Control Package 
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Table 2-28. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: E50H, 3664 MSR_C10_PMON_EVNTSELO 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 0 Package 
Register Address: 51H, 3665 MSR_C10_PMON_EVNTSEL1 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 1 Package 
Register Address: 52H, 3666 MSR_C10_PMON_EVNTSEL2 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 2 Package 
Register Address: E53H, 3667 MSR_C10_PMON_EVNTSEL3 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 3 Package 
Register Address: E54H, 3668 MSR_C10_PMON_BOX_FILTER 
Uncore C-Box 10 Perfmon Box Wide Filter Package 
Register Address: E56H, 3670 MSR_C10_PMON_CTRO 
Uncore C-Box 10 Perfmon Counter 0 Package 
Register Address: E57H, 3671 MSR_C10_PMON_CTR1 
Uncore C-Box 10 Perfmon Counter 1 Package 
Register Address: E58H, 3672 MSR_C10_PMON_CTR2 
Uncore C-Box 10 Perfmon Counter 2 Package 
Register Address: E59H, 3673 MSR_C10_PMON_CTR3 
Uncore C-Box 10 Perfmon Counter 3 Package 
Register Address: E5AH, 3674 MSR_C10_PMON_BOX_FILTER1 
Uncore C-Box 10 Perfmon Box Wide Filter1 Package 
Register Address: E64H, 3684 MSR_C11_PMON_BOX_CTL 
Uncore C-Box 11 Perfmon Local Box Wide Control Package 
Register Address: 70H, 3696 MSR_C11_PMON_EVNTSELO 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 0 Package 
Register Address: 71H, 3697 MSR_C11_PMON_EVNTSEL1 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 1 Package 
Register Address: E72H, 3698 MSR_C11_PMON_EVNTSEL2 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 2 Package 
Register Address: 73H, 3699 MSR_C11_PMON_EVNTSEL3 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 3 Package 
Register Address: E74H, 3700 MSR_C11_PMON_BOX_FILTER 
Uncore C-Box 11 Perfmon Box Wide Filter Package 
Register Address: E76H, 3702 MSR_C11_PMON_CTRO 
Uncore C-Box 11 Perfmon Counter O Package 
Register Address: E77H, 3703 MSR_C11_PMON_CTR1 
Uncore C-Box 11 Perfmon Counter 1 Package 


Register Address: €78H, 3704 
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Table 2-28. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 11 Perfmon Counter 2 Package 
Register Address: E79H, 3705 MSR_C11_PMON_CTR3 
Uncore C-Box 11 Perfmon Counter 3 Package 
Register Address: E7AH, 3706 MSR_C11_PMON_BOX_FILTER1 
Uncore C-Box 11 Perfmon Box Wide Filter1 Package 
Register Address: E84H, 3716 MSR_C12_PMON_BOX_CTL 
Uncore C-Box 12 Perfmon Local Box Wide Control Package 
Register Address: E90H, 3728 MSR_C12_PMON_EVNTSELO 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 0 Package 
Register Address: 91H, 3729 MSR_C12_PMON_EVNTSEL1 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 1 Package 
Register Address: 92H, 3730 MSR_C12_PMON_EVNTSEL2 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 2 Package 
Register Address: €93H, 3731 MSR_C12_PMON_EVNTSEL3 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 3 Package 
Register Address: E94H, 3732 MSR_C12_PMON_BOX_FILTER 
Uncore C-Box 12 Perfmon Box Wide Filter Package 
Register Address: E96H, 3734 MSR_C12_PMON_CTRO 
Uncore C-Box 12 Perfmon Counter 0 Package 
Register Address: 97H, 3735 MSR_C12_PMON_CTR1 
Uncore C-Box 12 Perfmon Counter 1 Package 
Register Address: E98H, 3736 MSR_C12_PMON_CTR2 
Uncore C-Box 12 Perfmon Counter 2 Package 
Register Address: E9SH, 3737 MSR_C12_PMON_CTR3 
Uncore C-Box 12 Perfmon Counter 3 Package 
Register Address: E9AH, 3738 MSR_C12_PMON_BOX_FILTER1 
Uncore C-Box 12 Perfmon Box Wide Filter1 Package 
Register Address: EA4H, 3748 MSR_C13_PMON_BOX_CTL 
Uncore C-Box 13 Perfmon Local Box Wide Control Package 
Register Address: EBOH, 3760 MSR_C13_PMON_EVNTSELO 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 0 Package 
Register Address: EB1H, 3761 MSR_C13_PMON_EVNTSEL1 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 1 Package 
Register Address: EB2H, 3762 MSR_C13_PMON_EVNTSEL2 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 2 Package 
Register Address: EB3H, 3763 MSR_C13_PMON_EVNTSEL3 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 3 Package 
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Table 2-28. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v2 and E7 v2 Families (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 
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Register Information / Bit Fields Bit Description Scope 
Register Address: EB4H, 3764 MSR_C13_PMON_BOX_FILTER 
Uncore C-Box 13 Perfmon Box Wide Filter Package 
Register Address: EB6H, 3766 MSR_C13_PMON_CTRO 
Uncore C-Box 13 Perfmon Counter 0 Package 
Register Address: EB7H, 3767 MSR_C13_PMON_CTR1 
Uncore C-Box 13 Perfmon Counter 1 Package 
Register Address: EB8H, 3768 MSR_C13_PMON_CTR2 
Uncore C-Box 13 Perfmon Counter 2 Package 
Register Address: EB9H, 3769 MSR_C13_PMON_CTR3 
Uncore C-Box 13 Perfmon Counter 3 Package 
Register Address: EBAH, 3770 MSR_C13_PMON_BOX_FILTER1 
Uncore C-Box 13 Perfmon Box Wide Filter1 Package 
Register Address: EC4H, 3780 MSR_C14_PMON_BOX_CTL 
Uncore C-Box 14 Perfmon Local Box Wide Control Package 
Register Address: EDOH, 3792 MSR_C14_PMON_EVNTSELO 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 0 Package 
Register Address: ED1H, 3793 MSR_C14_PMON_EVNTSEL1 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 1 Package 
Register Address: ED2H, 3794 MSR_C14_PMON_EVNTSEL2 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 2 Package 
Register Address: ED3H, 3795 MSR_C14_PMON_EVNTSEL3 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 3 Package 
Register Address: ED4H, 3796 MSR_C14_PMON_BOX_FILTER 
Uncore C-Box 14 Perfmon Box Wide Filter Package 
Register Address: ED6H, 3798 MSR_C14_PMON_CTRO 
Uncore C-Box 14 Perfmon Counter 0 Package 
Register Address: ED7H, 3799 MSR_C14_PMON_CTR1 
Uncore C-Box 14 Perfmon Counter 1 Package 
Register Address: ED8H, 3800 MSR_C14_PMON_CTR2 
Uncore C-Box 14 Perfmon Counter 2 Package 
Register Address: EDSH, 3801 MSR_C14_PMON_CTR3 
Uncore C-Box 14 Perfmon Counter 3 Package 
Register Address: EDAH, 3802 MSR_C14_PMON_BOX_FILTER1 
Uncore C-Box 14 Perfmon Box Wide Filter1 Package 
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HASWELL MICROARCHITECTURE 


The 4th generation Intel® Core™ processor family and the Intel® Xeon® processor E3-1200v3 product family 
(based on Haswell microarchitecture), with a CPUID Signature DisplayFamily_DisplayModel value of 06_3CH, 
06_45H, or 06_46H, support the MSR interfaces listed in Table 2-20, Table 2-21, Table 2-22, and Table 2-29. For 
an MSR listed in Table 2-20 that also appears in Table 2-29, Table 2-29 supersedes Table 2-20. 


The MSRs listed in Table 2-29 also apply to processors based on Haswell-E microarchitecture (see Section 2.14). 


MSRS IN THE 4TH GENERATION INTEL® CORE™ PROCESSORS BASED ON 


Table 2-29. Additional MSRs Supported by Processors Based on the Haswell and Haswell-E Microarchitectures 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

Register Address: 3BH, 59 IA32_TSC_ADJUST 

Per-Logical-Processor TSC ADJUST (R/W) Thread 

See Table 2-2. 

Register Address: CEH, 206 MSR_PLATFORM_INFO 

Platform Information Package 

Contains power management and other model specific features enumeration. See http://biosbits.org. 

7:0 Reserved. 

15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the frequency that invariant TSC runs at. Frequency = 
ratio * 100 MHz. 

27:16 Reserved. 

28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode is 
enabled. When set to O, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 

29 Programmable TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDP Limit for Turbo mode is programmable. 
When set to 0, indicates TDP Limit for Turbo mode is not programmable. 

31:30 Reserved. 

32 Low Power Mode Support (LPM) (R/O) Package 
When set to 1, indicates that LPM is supported. When set to O, indicates 
LPM is not supported. 

34:33 Number of ConfigTDP Levels (R/O) Package 
00: Only Base TDP level available. 
01: One additional TDP level available. 
02: Two additional TDP level available. 
03: Reserved. 

39:35 Reserved. 

47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 1OO0MHz. 

55:48 Minimum Operating Ratio (R/O) Package 
Contains the minimum supported operating ratio in units of 100 MHz. 

63:56 Reserved. 
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Table 2-29. Additional MSRs Supported by Processors Based on the Haswell and Haswell-€ Microarchitectures 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 186H, 390 IA32_PERFEVTSELO 
Performance Event Select for Counter 0 (R/W) Thread 
Supports all fields described inTable 2-2 and the fields below. 
32 IN_TX: See Section 20.3.6.5.1. 
When IN_TX (bit 32) is set, AnyThread (bit 21) should be cleared to 
prevent incorrect results. 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
Performance Event Select for Counter 1 (R/W) Thread 
Supports all fields described inTable 2-2 and the fields below. 
32 IN_TX: See Section 20.3.6.5.1. 


When IN_TX (bit 32) is set, AnyThread (bit 21) should be cleared to 
prevent incorrect results. 


Register Address: 188H, 392 IA32_PERFEVTSEL2 


Performance Event Select for Counter 2 (R/W) Thread 
Supports all fields described inTable 2-2 and the fields below. 


32 IN_TX: See Section 20.3.6.5.1. 


When IN_TX (bit 32) is set, AnyThread (bit 21) should be cleared to 
prevent incorrect results. 


33 IN_TXCP: See Section 20.3.6.5.1. 


When IN_TXCP=1 & IN_TX=1 and in sampling, a spurious PMI may occur 
and transactions may continuously abort near overflow conditions. 
Software should favor using IN_TXCP for counting over sampling. If 
sampling, software should use large “sample-after” value after clearing 
the counter configured to use IN_TXCP and also always reset the counter 
even when no overflow condition was reported. 


Register Address: 189H, 393 IA32_PERFEVTSEL3 
Performance Event Select for Counter 3 (R/W) Thread 
Supports all fields described inTable 2-2 and the fields below. 
32 IN_TX: See Section 20.3.6.5.1 
When IN_TX (bit 32) is set, AnyThread (bit 21) should be cleared to 
prevent incorrect results. 
Register Address: 1C8H, 456 MSR_LBR_SELECT 
Last Branch Record Filtering Select Register (R/W) Thread 
0 CPL_EQ_O 
1 CPL_NEQ_O 
2 JCC 
3 NEAR_REL_CALL 
4 NEAR_IND_CALL 
5 NEAR_RET 
6 NEAR_IND_JMP 
7 NEAR_REL_JMP 
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Table 2-29. Additional MSRs Supported by Processors Based on the Haswell and Haswell-E Microarchitectures 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

8 FAR_BRANCH 

9 EN_CALL_STACK 

63:9 Reserved. 

Register Address: 1D9H, 473 IA32_DEBUGCTL 

Debug Control (R/W) Thread 

See Table 2-2. 

0 LBR: Last Branch Record 

BTF 

5:2 Reserved. 

6 TR: Branch Trace 

7 BTS: Log Branch Trace Message to BTS Buffer 

8 BTINT 

9 BTS_OFF_OS 

10 BTS_OFF_USER 

11 FREEZE_LBR_ON_PMI 

12 FREEZE_PERFMON_ON_PMI 

13 ENABLE_UNCORE_PMI 

14 FREEZE_WHILE_SMM 

15 RTM_DEBUG 

63:15 Reserved. 

Register Address: 491H, 1169 1A32_VMX_VMFUNC 

Capability Reporting Register of VM-Function Controls (R/O) Thread 

See Table 2-2. 

Register Address: 60BH, 1548 MSR_PKGC_IRTL1 

Package C6/C7 Interrupt Response Limit 1 (R/W) Package 

This MSR defines the interrupt response time limit used by the processor to manage a transition to a package C6 or 

C7 state. The latency programmed in this register is for the shorter-latency sub C-states used by an MWAIT hint to a 

C6 or C7 state. 

Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 

ACPI C-States. 

9:0 Interrupt Response Time Limit (R/W) 
Specifies the limit that should be used to decide if the package should be 
put into a package C6 or C7 state. 

12:10 Time Unit (R/W) 
Specifies the encoding value of time unit of the interrupt response time 
limit. See Table 2-20 for supported time unit encodings. 

14:13 Reserved. 

15 Valid (R/W) 
Indicates whether the values in bits 12:0 are valid and can be used by 
the processor for package C-sate management. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
63:16 Reserved. 
Register Address: 60CH, 1548 MSR_PKGC_IRTL2 
Package C6/C7 Interrupt Response Limit 2 (R/W) Package 


This MSR defines the interrupt response time limit used by the processor to manage a transition to a package C6 or 
C7 state. The latency programmed in this register is for the longer-latency sub C-states used by an MWAIT hint to a C6 
or C7 state. 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


9:0 Interrupt response time limit (R/W) 


Specifies the limit that should be used to decide if the package should be 
put into a package C6 or C7 state. 


12:10 Time Unit (R/W) 


Specifies the encoding value of time unit of the interrupt response time 
limit. See Table 2-20 for supported time unit encodings. 


14:13 Reserved. 


15 Valid (R/W) 


Indicates whether the values in bits 12:0 are valid and can be used by 
the processor for package C-sate management. 


63:16 Reserved. 
Register Address: 613H, 1555 MSR_PKG_PERF_STATUS 
PKG Perf Status (R/O) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 648H, 1608 MSR_CONFIG_TDP_NOMINAL 
Base TDP Ratio (R/O) Package 
7:0 Config_TDP_Base 
Base TDP level ratio to be used for this specific processor (in units of 100 
MHz). 
63:8 Reserved. 
Register Address: 649H, 1609 MSR_CONFIG_TDP_LEVEL1 
ConfigTDP Level 1 Ratio and Power Level (R/O) Package 
14:0 PKG_TDP_LVL1 
Power setting for ConfigTDP Level 1. 
15 Reserved. 
23:16 Config_TDP_LVL1_Ratio 


ConfigTDP level 1 ratio to be used for this specific processor. 
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Table 2-29. Additional MSRs Supported by Processors Based on the Haswell and Haswell-E Microarchitectures 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
31:24 Reserved. 
46:32 PKG_MAX_PWR_LVL1 
Max Power setting allowed for ConfigTDP Level 1. 
62:47 PKG_MIN_PWR_LVL1 
MIN Power setting allowed for ConfigTDP Level 1. 
63 Reserved. 
Register Address: 64AH, 1610 MSR_CONFIG_TDP_LEVEL2 
ConfigTDP Level 2 Ratio and Power Level (R/O) Package 
14:0 PKG_TDP_LVL2 
Power setting for ConfigTDP Level 2. 
15 Reserved. 
23:16 Config_TDP_LVL2_Ratio 
ConfigTDP level 2 ratio to be used for this specific processor. 
31:24 Reserved. 
46:32 PKG_MAX_PWR_LVL2 
Max Power setting allowed for ConfigTDP Level 2. 
62:47 PKG_MIN_PWR_LVL2 
MIN Power setting allowed for ConfigTDP Level 2. 
63 Reserved. 
Register Address: 64BH, 1611 MSR_CONFIG_TDP_CONTROL 
ConfigTDP Control (R/W) Package 
1:0 TDP_LEVEL (RW/L) 
System BIOS can program this field. 
30:2 Reserved. 
31 Config_TDP_Lock (RW/L) 
When this bit is set, the content of this register is locked until a reset. 
63:32 Reserved. 
Register Address: 64CH, 1612 MSR_TURBO_ACTIVATION_RATIO 
ConfigTDP Control (R/W) Package 
7:0 MAX_NON_TURBO_RATIO (RW/L) 
System BIOS can program this field. 
30:8 Reserved. 
31 TURBO_ACTIVATION_RATIO_Lock (RW/L) 
When this bit is set, the content of this register is locked until a reset. 
63:32 Reserved. 
Register Address: C80H, 3200 1A32_DEBUG_INTERFACE 
Silicon Debug Feature Control (R/W) Package 


See Table 2-2. 
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2.13.1 MSRs in the 4th Generation Intel® Core™ Processor Family Based on Haswell 


Microarchitecture 


Table 2-30 lists model-specific registers (MSRs) that are specific to the 4th generation Intel® Core™ processor 
family and the Intel® Xeon® processor E3-1200 v3 product family (based on Haswell microarchitecture). These 


processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_3CH, 06_45H, or 06_46H; see Table 


2-1. 


Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Reports SMM capability Enhancement. Accessible only while in SMM. 


Register Information / Bit Fields Bit Description Scope 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. See http://biosbits.org. 
3:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name 
(consuming the least power) for the package. The default is set 
as factory-configured package C-state limit. 
The following C-state code name encodings are supported: 
QO000b: CO/C1 (no package C-state support) 
0001b: C2 
001 0b: C3 
001 1b: C6 
0100b: C7 
0101b: C7s 
Package C states C7 are not available to processors with a 
CPUID Signature DisplayFamily_DisplayModel value of 06_3CH. 
9:4 Reserved. 
10 I/O MWAIT Redirection Enable (R/W) 
14:11 Reserved 
15 CFG Lock (R/WO) 
24:16 Reserved. 
25 C3 State Auto Demotion Enable (R/W) 
26 C1 State Auto Demotion Enable (R/W) 
27 Enable C3 Undemotion (R/W) 
28 Enable C1 Undemotion (R/W) 
63:29 Reserved. 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Thread 


57:0 


Reserved. 


58 


SMM_Code_Access_Chk (SMM-RO) 


If set to 1, indicates that the SMM code access restriction is 
supported and the MSR_SMM_FEATURE_CONTROL is 
supported. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

59 Long_Flow_Indication (SMM-RO) 
If set to 1, indicates that the SMM long flow indicator is 
supported and the MSR_SMM_DELAYED is supported. 

63:60 Reserved. 

Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 

7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 

63:32 Reserved. 

Register Address: 391H, 913 MSR_UNC_PERF_GLOBAL_CTRL 

Uncore PMU Global Control Package 

0 Core 0 select. 

1 Core 1 select. 

2 Core 2 select. 

3 Core 3 select. 

18:4 Reserved. 

29 Enable all uncore counters. 

30 Enable wake on PMI. 

31 Enable Freezing counter when overflow. 

63:32 Reserved. 

Register Address: 392H, 914 MSR_UNC_PERF_GLOBAL_STATUS 

Uncore PMU Main Status Package 

0 Fixed counter overflowed. 

1 An ARB counter overflowed. 

2 Reserved. 

3 A CBox counter overflowed (on any slice). 

63:4 Reserved. 

Register Address: 394H, 916 MSR_UNC_PERF_FIXED_CTRL 

Uncore Fixed Counter Control (R/W) Package 

19:0 Reserved. 

20 Enable overflow propagation. 

21 Reserved. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
22 Enable counting. 
63:23 Reserved. 
Register Address: 395H, 917 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
47:0 Current count. 
63:48 Reserved. 
Register Address: 396H, 918 MSR_UNC_CBO_CONFIG 
Uncore C-Box Configuration Information (R/O) Package 
3:0 Encoded number of C-Box, derive value by “-1". 
63:4 Reserved. 
Register Address: 3BOH, 946 MSR_UNC_ARB_PERFCTRO 
Uncore Arb Unit, Performance Counter O Package 
Register Address: 3B1H, 947 MSR_UNC_ARB_PERFCTR1 
Uncore Arb Unit, Performance Counter 1 Package 
Register Address: 3B2H, 944 MSR_UNC_ARB_PERFEVTSELO 
Uncore Arb Unit, Counter 0 Event Select MSR Package 
Register Address: 3B3H, 945 MSR_UNC_ARB_PERFEVTSEL1 
Uncore Arb Unit, Counter 1 Event Select MSR Package 
Register Address: 391H, 913 MSR_UNC_PERF_GLOBAL_CTRL 
Uncore PMU Global Control Package 
0 Core 0 select. 
1 Core 1 select. 
2 Core 2 select. 
3 Core 3 select. 
18:4 Reserved. 
29 Enable all uncore counters. 
30 Enable wake on PMI. 
31 Enable Freezing counter when overflow. 
63:32 Reserved. 
Register Address: 395H, 917 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
47:0 Current count. 
63:48 Reserved. 
Register Address: 3B3H, 945 MSR_UNC_ARB_PERFEVTSEL1 
Uncore Arb Unit, Counter 1 Event Select MSR Package 
Register Address: 4E€0H, 1248 MSR_SMM_FEATURE_CONTROL 
Enhanced SMM Feature Control (SMM-RW) Package 


Reports SMM capability Enhancement. Accessible only while in SMM. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
0 Lock (SMM-RWO) 
When set to ‘1’ locks this register from further changes. 
1 Reserved. 
2 SMM_Code_Chk_En (SMM-RW) 


This control bit is available only if MSR_SMM_MCA_CAP[58] == 
1. When set to ‘0’ (default) none of the logical processors are 
prevented from executing SMM code outside the ranges defined 
by the SMRR. 

When set to ‘1’ any logical processor in the package that 
attempts to execute SMM code not within the ranges defined 
by the SMRR will assert an unrecoverable MCE. 


63:3 Reserved. 
Register Address: 4E2H, 1250 MSR_SMM_DELAYED 
SMM Delayed (SMM-RO) Package 


Reports the interruptible state of all logical processors in the package. Available only while in SMM and 
MSR_SMM_MCA_CAP[LONG_FLOW_INDICATION] == 1. 


N-1:0 LOG_PROC_STATE (SMM-RO) 


Each bit represents a logical processor of its state in along flow 
of internal operation which delays servicing an interrupt. The 
corresponding bit will be set at the start of long events such as: 
Microcode Update Load, C6, WBINVD, Ratio Change, Throttle. 


The bit is automatically cleared at the end of each long event. 
The reset value of this field is 0. 

Only bit positions below N = CPUID.(EAX=OBH, 
ECX=PKG_LVL):EBX[1 5:0] can be updated. 


63:N Reserved. 

Register Address: 4€3H, 1251 MSR_SMM_BLOCKED 

SMM Blocked (SMM-RO) Package 
Reports the blocked state of all logical processors in the package. Available only while in SMM. 

N-1:0 LOG_PROC_STATE (SMM-RO) 


Each bit represents a logical processor of its blocked state to 
service an SMI. The corresponding bit will be set if the logical 
processor is in one of the following states: Wait For SIPI or 
SENTER Sleep. 


The reset value of this field is OFFFH. 


Only bit positions below N = CPUID.(EAX=OBH, 
ECX=PKG_LVL):EBX[15:0] can be updated. 


63:N Reserved. 

Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 

Unit Multipliers Used in RAPL Interfaces (R/O) Package 

3:0 Power Units Package 
See Section 15.10.1, “RAPL Interfaces.” 

7:4 Reserved. Package 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
12:8 Energy Status Units Package 
Energy related information (in Joules) is based on the multiplier, 
1/2” ESU; where ESU is an unsigned integer represented by bits 
12:8. Default value is OEH (or 61 micro-joules). 
15:13 Reserved. Package 
19:16 Time Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
63:20 Reserved. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 640H, 1600 MSR_PP1_POWER_LIMIT 
PP1 RAPL Power Limit Control (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 641H, 1601 MSR_PP1_ENERGY_STATUS 
PP1 Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 642H, 1602 MSR_PP1_POLICY 
PP1 Balance Policy (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 690H, 1680 MSR_CORE_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in Processor Cores (R/W) Package 
(Frequency refers to processor core frequency.) 
0 PROCHOT Status (RO) 


When set, processor core frequency is reduced below the 
operating system request due to assertion of external 
PROCHOT. 


1 Thermal Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal event. 


3:2 Reserved. 


4 Graphics Driver Status (RO) 


When set, frequency is reduced below the operating system 
request due to Processor Graphics driver override. 


5 Autonomous Utilization-Based Frequency Control Status (RO) 


When set, frequency is reduced below the operating system 
request because the processor has detected that utilization is 
low. 


6 VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal alert from the Voltage Regulator. 


7 Reserved. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Electrical Design Point Status (RO) 


When set, frequency is reduced below the operating system 
request due to electrical design point constraints (e.g., 
maximum electrical current consumption). 


Core Power Limiting Status (RO) 


When set, frequency is reduced below the operating system 
request due to domain-level power limiting. 


Package-Level Power Limiting PL1 Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL1. 


Package-Level PL2 Power Limiting Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL2. 


Max Turbo Limit Status (RO) 


When set, frequency is reduced below the operating system 
request due to multi-core turbo limits. 


15:14 


Turbo Transition Attenuation Status (RO) 

When set, frequency is reduced below the operating system 
request due to Turbo transition attenuation. This prevents 
performance degradation due to frequent operating ratio 
changes. 


Reserved. 


PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


Thermal Log 


When set, indicates that the Thermal Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


19:18 


Reserved. 


20 


Graphics Driver Log 


When set, indicates that the Graphics Driver Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


21 


Autonomous Utilization-Based Frequency Control Log 


When set, indicates that the Autonomous Utilization-Based 
Frequency Control Status bit has asserted since the log bit was 
last cleared. 


This log bit will remain set until cleared by software writing O. 


22 


VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
23 Reserved. 
24 Electrical Design Point Log 


When set, indicates that the EDP Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


25 Core Power Limiting Log 


When set, indicates that the Core Power Limiting Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


26 Package-Level PL1 Power Limiting Log 


When set, indicates that the Package Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


27 Package-Level PL2 Power Limiting Log 


When set, indicates that the Package Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


28 Max Turbo Limit Log 


When set, indicates that the Max Turbo Limit Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


29 Turbo Transition Attenuation Log 


When set, indicates that the Turbo Transition Attenuation 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


63:30 Reserved. 


Register Address: 6BOH, 1712 MSR_GRAPHICS_PERF_LIMIT_REASONS 


Indicator of Frequency Clipping in the Processor Graphics (R/W) Package 
(Frequency refers to processor graphics frequency.) 


0 PROCHOT Status (RO) 


When set, frequency is reduced below the operating system 
request due to assertion of external PROCHOT. 


1 Thermal Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal event. 


3:2 Reserved. 


4 Graphics Driver Status (RO) 


When set, frequency is reduced below the operating system 
request due to Processor Graphics driver override. 


5 Autonomous Utilization-Based Frequency Control Status (RO) 


When set, frequency is reduced below the operating system 
request because the processor has detected that utilization is 
low. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
6 VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal alert from the Voltage Regulator. 


Reserved. 


Electrical Design Point Status (RO) 

When set, frequency is reduced below the operating system 
request due to electrical design point constraints (e.g, 
maximum electrical current consumption). 


9 Graphics Power Limiting Status (RO) 


When set, frequency is reduced below the operating system 
request due to domain-level power limiting. 


10 Package-Level Power Limiting PL1 Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL1. 


11 Package-Level PL2 Power Limiting Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL2. 


15:12 Reserved. 


16 PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 
17 Thermal Log 


When set, indicates that the Thermal Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


19:18 Reserved. 


20 Graphics Driver Log 


When set, indicates that the Graphics Driver Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 
21 Autonomous Utilization-Based Frequency Control Log 


When set, indicates that the Autonomous Utilization-Based 
Frequency Control Status bit has asserted since the log bit was 


last cleared. 
This log bit will remain set until cleared by software writing O. 
22 VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


23 Reserved. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
24 Electrical Design Point Log 


When set, indicates that the EDP Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


25 Core Power Limiting Log 


When set, indicates that the Core Power Limiting Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


26 Package-Level PL1 Power Limiting Log 


When set, indicates that the Package Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


27 Package-Level PL2 Power Limiting Log 


When set, indicates that the Package Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


28 Max Turbo Limit Log 


When set, indicates that the Max Turbo Limit Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


29 Turbo Transition Attenuation Log 


When set, indicates that the Turbo Transition Attenuation 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


63:30 Reserved. 


Register Address: 6B1H, 1713 MSR_RING_PERF_LIMIT_REASONS 


Indicator of Frequency Clipping in the Ring Interconnect (R/W) Package 
(Frequency refers to ring interconnect in the uncore.) 


0 PROCHOT Status (RO) 


When set, frequency is reduced below the operating system 
request due to assertion of external PROCHOT. 


1 Thermal Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal event. 


5:2 Reserved. 


VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system 
request due to a thermal alert from the Voltage Regulator. 


Reserved. 


Electrical Design Point Status (RO) 


When set, frequency is reduced below the operating system 
request due to electrical design point constraints (e.g., 
maximum electrical current consumption). 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Reserved. 


Package-Level Power Limiting PL1 Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL1. 


Package-Level PL2 Power Limiting Status (RO) 


When set, frequency is reduced below the operating system 
request due to package-level power limiting PL2. 


15:12 


Reserved. 


PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


Thermal Log 


When set, indicates that the Thermal Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


19:18 


Reserved. 


20 


Graphics Driver Log 


When set, indicates that the Graphics Driver Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


21 


Autonomous Utilization-Based Frequency Control Log 


When set, indicates that the Autonomous Utilization-Based 
Frequency Control Status bit has asserted since the log bit was 
last cleared. 


This log bit will remain set until cleared by software writing O. 


22 


VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


23 


Reserved. 


24 


Electrical Design Point Log 


When set, indicates that the EDP Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


25 


Core Power Limiting Log 


When set, indicates that the Core Power Limiting Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


26 


Package-Level PL1 Power Limiting Log 


When set, indicates that the Package Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 
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Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

27 Package-Level PL2 Power Limiting Log 

When set, indicates that the Package Level PL2 Power Limiting 

Status bit has asserted since the log bit was last cleared. 

This log bit will remain set until cleared by software writing 0. 
28 Max Turbo Limit Log 

When set, indicates that the Max Turbo Limit Status bit has 

asserted since the log bit was last cleared. 

This log bit will remain set until cleared by software writing O. 
29 Turbo Transition Attenuation Log 

When set, indicates that the Turbo Transition Attenuation 

Status bit has asserted since the log bit was last cleared. 

This log bit will remain set until cleared by software writing O. 
63:30 Reserved. 
Register Address: 700H, 1792 MSR_UNC_CBO_0O_PERFEVTSELO 
Uncore C-Box 0, Counter O Event Select MSR Package 
Register Address: 701H, 1793 MSR_UNC_CBO_O_PERFEVTSEL1 
Uncore C-Box 0, Counter 1 Event Select MSR Package 
Register Address: 706H, 1798 MSR_UNC_CBO_0O_PERFCTRO 
Uncore C-Box 0, Performance Counter 0 Package 
Register Address: 707H, 1799 MSR_UNC_CBO_O_PERFCTR1 
Uncore C-Box 0, Performance Counter 1 Package 
Register Address: 710H, 1808 MSR_UNC_CBO_1_PERFEVTSELO 
Uncore C-Box 1, Counter O Event Select MSR Package 
Register Address: 711H, 1809 MSR_UNC_CBO_1_PERFEVTSEL1 
Uncore C-Box 1, Counter 1 Event Select MSR Package 
Register Address: 716H, 1814 MSR_UNC_CBO_1_PERFCTRO 
Uncore C-Box 1, Performance Counter O Package 
Register Address: 717H, 1815 MSR_UNC_CBO_1_PERFCTR1 
Uncore C-Box 1, Performance Counter 1 Package 
Register Address: 720H, 1824 MSR_UNC_CBO_2_PERFEVTSELO 
Uncore C-Box 2, Counter O Event Select MSR Package 
Register Address: 721H, 1824 MSR_UNC_CBO_2_PERFEVTSEL1 
Uncore C-Box 2, Counter 1 Event Select MSR Package 
Register Address: 726H, 1830 MSR_UNC_CBO_2_PERFCTRO 
Uncore C-Box 2, Performance Counter 0 Package 
Register Address: 727H, 1831 MSR_UNC_CBO_2_PERFCTR1 
Uncore C-Box 2, Performance Counter 1 Package 
Register Address: 730H, 1840 MSR_UNC_CBO_3_PERFEVTSELO 
Uncore C-Box 3, Counter O Event Select MSR Package 


2-274 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-30. MSRs Supported by 4th Generation Intel® Core™ Processors (Haswell Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 731H, 1841 MSR_UNC_CBO_3_PERFEVTSEL1 
Uncore C-Box 3, Counter 1 Event Select MSR Package 
Register Address: 736H, 1846 MSR_UNC_CBO_3_PERFCTRO 
Uncore C-Box 3, Performance Counter 0 Package 
Register Address: 737H, 1847 MSR_UNC_CBO_3_PERFCTR1 
Uncore C-Box 3, Performance Counter 1 Package 
See Table 2-20, Table 2-21, Table 2-22, Table 2-25, and Table 2-29 for other MSR definitions applicable to processors with a CPUID 
Signature DisplayFamily_DisplayModel value of O63CH or O6_46H. 


2.13.2 


Additional Residency MSRs Supported in 4th Generation Intel® Core™ Processors 


The 4th generation Intel® Core™ processor family (based on Haswell microarchitecture) with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_45H supports the MSR interfaces listed in Table 2-20, Table 2-21, Table 


2-29, Table 2-30, and Table 2-31. 


Table 2-31. Additional Residency MSRs Supported by 4th Generation Intel® Core™ Processors with a 
CPUID Signature DisplayFamily_DisplayModel Value of 06_45H 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 


ACPI C-states. See http://biosbits.org. 


3:0 


Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 


package C-state limit. 


The following C-state code name encodings are supported: 


O0000b: CO/C1 (no package C-state support) 


0001b: C2 
001 Ob: C3 
001 1b: C6 
0100b: C7 
0101b: C7s 
0110b: C8 
0111b: C9 
1000b: C10 


9:4 


Reserved. 


10 


1/0 MWAIT Redirection Enable (R/W) 


14:11 
15 


Reserved. 
CFG Lock (R/WO) 


24:16 


Reserved. 
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Table 2-31. Additional Residency MSRs Supported by 4th Generation Intel® Core” Processors with a 
CPUID Signature DisplayFamily_DisplayModel Value of 06_45H 


Register Address: Hex, Decimal 


Register Name 


ACPI C-States. 


Register Information / Bit Fields Bit Description Scope 
25 C3 State Auto Demotion Enable (R/W) 
26 C1 State Auto Demotion Enable (R/W) 
27 Enable C3 Undemotion (R/W) 
28 Enable C1 Undemotion (R/W) 
63:29 Reserved. 
Register Address: 630H, 1584 MSR_PKG_C8_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
59:0 Package C8 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C8 states. 
Count at the same frequency as the TSC. 
63:60 Reserved. 
Register Address: 631H, 1585 MSR_PKG_C9_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 
ACPI C-States. 
59:0 Package C9 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C9 states. 
Count at the same frequency as the TSC. 
63:60 Reserved. 
Register Address: 632H, 1586 MSR_PKG_C10_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or | Package 


59:0 Package C10 Residency Counter (R/O) 
Value since last reset that this package is in processor-specific C10 states. 
Count at the same frequency as the TSC. 

63:60 Reserved. 


See Table 2-20, Table 2-21, Table 2-22, Table 2-29, and Table 2-30 for other MSR definitions applicable to processors with a CPUID 
Signature DisplayFamily_DisplayModel value of O6_45H. 


2.14 
FAMILY 


MSRS IN THE INTEL® XEON® PROCESSOR E5 V3 AND E7 V3 PRODUCT 


The Intel® Xeon® processor E5 v3 family and the Intel® Xeon® processor E7 v3 family are based on Haswell-E 
microarchitecture (CPUID Signature DisplayFamily_DisplayModel value of 06_3F). These processors support the 


MSR interfaces listed in Table 2-20, 


Table 2-32. Additio 


Table 2-29, and Table 2-32. 


nal MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 35H, 53 


MSR_CORE_THREAD_COUNT 
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Table 2-32. Additional MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Configured State of Enabled Processor Core Count and Logical Processor Count (R/O) Package 


« After a Power-On RESET, enumerates factory configuration of the number of processor cores and logical 
processors in the physical package. 

* Following the sequence of (i) BIOS modified a Configuration Mask which selects a subset of processor cores to be 
active post RESET and (ii) a RESET event after the modification, enumerates the current configuration of enabled 
processor core count and logical processor count in the physical package. 


15:0 THREAD_COUNT (R/O) 


The number of logical processors that are currently enabled (by either 
factory configuration or BIOS configuration) in the physical package. 


31:16 Core_COUNT (R/O) 


The number of processor cores that are currently enabled (by either factory 
configuration or BIOS configuration) in the physical package. 


63:32 Reserved. 

Register Address: 53H, 83 MSR_THREAD_ID_INFO 

A Hardware Assigned ID for the Logical Processor (R/O) Thread 
7:0 Logical_Processor_ID (R/O) 


An implementation-specific numerical value physically assigned to each 
logical processor. This ID is not related to Initial APIC ID or x2APIC ID, it is 
unique within a physical package. 


63:8 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. 


See http://biosbits.org. 
2:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
O000b: CO/C1 (no package C-state support) 
001b: C2 
010b: C6 (non-retention) 
011b: C6 (retention) 
111b: No Package C state limits. All C states supported by the processor are 
available. 
9:3 Reserved. 
10 I/O MWAIT Redirection Enable (R/W) 
14:11 Reserved. 
15 CFG Lock (R/WO) 
24:16 Reserved. 
25 C3 State Auto Demotion Enable (R/W) 
26 C1 State Auto Demotion Enable (R/W) 
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Table 2-32. Additional MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
27 Enable C3 Undemotion (R/W) 
28 Enable C1 Undemotion (R/W) 
29 Package C State Demotion Enable (R/W) 
30 Package C State Undemotion Enable (R/W) 
63:31 Reserved. 
Register Address: 179H, 377 IA32_MCG_CAP 
Global Machine Check Capability (R/O) Thread 
7:0 Count 
8 MCG_CTL_P 
9 MCG_EXT_P 
10 MCP_CMCI_P 
11 MCG_TES_P 
15:12 Reserved. 
23:16 MCG_EXT_CNT 
24 MCG_SER_P 
25 MCG_EM_P 
26 MCG_ELOG_P 
63:27 Reserved. 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Thread 
Reports SMM capability Enhancement. Accessible only while in SMM. 
57:0 Reserved. 
58 SMM_Code_Access_Chk (SMM-RO) 
If set to 1, indicates that the SMM code access restriction is supported and a 
host-space interface available to SMM handler. 
59 Long_Flow_Indication (SMM-RO) 
If set to 1, indicates that the SMM long flow indicator is supported and a 
host-space interface available to SMM handler. 
63:60 Reserved. 
Register Address: 17FH, 383 MSR_ERROR_CONTROL 
MC Bank Error Configuration (R/W) Package 
0 Reserved. 
1 Mem€Error Log Enable (R/W) 
When set, enables IMC status bank to log additional info in bits 36:32. 
63:2 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Maximum Ratio Limit of Turbo Mode Package 


R/O if MSR_PLATFORM_INFO,[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 
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Table 2-32. Additional MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 

7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 

23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 

31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 

39:32 Maximum Ratio Limit for 5C Package 
Maximum turbo ratio limit of 5 core active. 

47:40 Maximum Ratio Limit for 6C Package 
Maximum turbo ratio limit of 6 core active. 

55:48 Maximum Ratio Limit for 7C Package 
Maximum turbo ratio limit of 7 core active. 

63:56 Maximum Ratio Limit for 8C Package 
Maximum turbo ratio limit of 8 core active. 

Register Address: 1 AEH, 430 MSR_TURBO_RATIO_LIMIT1 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO[28] = 0, and R/W if MSR_PLATFORM_INFO[28] = 1. 

7:0 Maximum Ratio Limit for 9C Package 
Maximum turbo ratio limit of 9 core active. 

15:8 Maximum Ratio Limit for 10C Package 
Maximum turbo ratio limit of 10 core active. 

23:16 Maximum Ratio Limit for 11C Package 
Maximum turbo ratio limit of 11 core active. 

31:24 Maximum Ratio Limit for 12C Package 
Maximum turbo ratio limit of 12 core active. 

39:32 Maximum Ratio Limit for 13C Package 
Maximum turbo ratio limit of 13 core active. 

47:40 Maximum Ratio Limit for 14C Package 
Maximum turbo ratio limit of 14 core active. 

55:48 Maximum Ratio Limit for 15C Package 
Maximum turbo ratio limit of 15 core active. 

63:56 Maximum Ratio Limit for16C Package 
Maximum turbo ratio limit of 16 core active. 

Register Address: 1 AFH, 431 MSR_TURBO_RATIO_LIMIT2 

Maximum Ratio Limit of Turbo Mode Package 

R/O if MSR_PLATFORM_INFO[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 

7:0 Maximum Ratio Limit for 17C Package 
Maximum turbo ratio limit of 17 core active. 
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Table 2-32. Additional MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Bank MC7 reports MC errors from the home agent HA 0. 


Register Information / Bit Fields Bit Description Scope 
15:8 Maximum Ratio Limit for 18C Package 
Maximum turbo ratio limit of 18 core active. 

62:16 Reserved. Package 

63 Semaphore for Turbo Ratio Limit Configuration Package 
If 1, the processor uses override configuration’ specified in 
MSR_TURBO_RATIO_LIMIT, MSR_TURBO_RATIO_LIMIT1, and 
MSR_TURBO_RATIO_LIMIT2. 
If O, the processor uses factory-set configuration (Default). 

Register Address: 414H, 1044 IA32_MC5_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC5 reports MC errors from the Intel QPI O module. 

Register Address: 415H, 1045 IA32_MC5_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC5 reports MC errors from the Intel QPI O module. 

Register Address: 416H, 1046 IA32_MC5_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC5 reports MC errors from the Intel QPI O module. 

Register Address: 41 7H, 1047 IA32_MC5_MISC 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC5 reports MC errors from the Intel QPI O module. 

Register Address: 418H, 1048 IA32_MC6_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC6 reports MC errors from the integrated I/O module. 

Register Address: 419H, 1049 1A32_MC6_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC6 reports MC errors from the integrated I/O module. 

Register Address: 41AH, 1050 IA32_MC6_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC6 reports MC errors from the integrated I/O module. 

Register Address: 41BH, 1051 IA32_MC6_MISC 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC6 reports MC errors from the integrated I/O module. 

Register Address: 41CH, 1052 IA32_MC7_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 

Bank MC7 reports MC errors from the home agent HA 0. 

Register Address: 41DH, 1053 IA32_MC7_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Register Address: 41€H, 1054 IA32_MC7_ADDR 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC7 reports MC errors from the home agent HA 0. 


Register Address: 41FH, 1055 IA32_MC7_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC7 reports MC errors from the home agent HA 0. 


Register Address: 420H, 1056 IA32_MC8_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC8 reports MC errors from the home agent HA 1. 


Register Address: 421H, 1057 IA32_MC8_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC8 reports MC errors from the home agent HA 1. 


Register Address: 422H, 1058 IA32_MC8_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC8 reports MC errors from the home agent HA 1. 


Register Address: 423H, 1059 IA32_MC8_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC8 reports MC errors from the home agent HA 1. 

Register Address: 424H, 1060 IA32_MC9_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 425H, 1061 IA32_MC9_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 426H, 1062 IA32_MC9_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 427H, 1063 IA32_MC9_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 428H, 1064 IA32_MC10_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 429H, 1065 IA32_MC10_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42AH, 1066 IA32_MC10_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42BH, 1067 IA32_MC10_MISC 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42CH, 1068 IA32_MC11_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42DH, 1069 IA32_MC11_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42EH, 1070 IA32_MC11_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 42FH, 1071 IA32_MC11_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 430H, 1072 IA32_MC12_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 431H, 1073 IA32_MC12_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 432H, 1074 IA32_MC12_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 433H, 1075 IA32_MC12_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 434H, 1076 IA32_MC13_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 435H, 1077 IA32_MC13_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 436H, 1078 IA32_MC13_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 437H, 1079 IA32_MC13_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 438H, 1080 IA32_MC14_CTL 


2-282 Vol. 4 


Table 2-32. Additional MSRs Supported by the Intel® Xeon® Processor E5 v3 Family 


MODEL-SPECIFIC REGISTERS (MSRS) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 439H, 1081 


IA32_MC14_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 43AH, 1082 


IA32_MC14_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 43BH, 1083 


IA32_MC14_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 43CH, 1084 


IA32_MC15_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 43DH, 1085 


IA32_MC15_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 43E€H, 1086 


IA32_MC15_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


IA32_MC15_MISC 


Register Address: 43FH, 1087 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 440H, 1088 


IA32_MC16_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


IA32_MC16_STATUS 


Register Address: 441H, 1089 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 442H, 1090 


IA32_MC16_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 443H, 1091 


IA32_MC16_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 444H, 1092 


IA32_MC17_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 


CBo1 2, CBo15. 


Package 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 445H, 1093 IA32_MC17_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 446H, 1094 IA32_MC17_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 447H, 1095 IA32_MC17_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 448H, 1096 IA32_MC18_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 449H, 1097 IA32_MC18_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 44AH, 1098 IA32_MC18_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 44BH, 1099 IA32_MC18_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 44CH, 1100 IA32_MC19_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Register Address: 44DH, 1101 IA32_MC19_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Register Address: 44EH, 1102 IA32_MC19_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Register Address: 44FH, 1103 IA32_MC19_MISC 
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Bank MC20 reports MC errors from the Intel QPI 1 module. 


Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 

CBo11, CBo14, CBo17. 

Register Address: 450H, 1104 IA32_MC20_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC20 reports MC errors from the Intel QPI 1 module. 

Register Address: 451H, 1105 IA32_MC20_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC20 reports MC errors from the Intel QPI 1 module. 

Register Address: 452H, 1106 IA32_MC20_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC20 reports MC errors from the Intel QPI 1 module. 


Register Address: 453H, 1107 IA32_MC20_MISC 


Package 


Register Address: 454H, 1108 IA32_MC21_CTL 


Bank MC21 reports MC errors from the Intel QPI 2 module. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 

Register Address: 455H, 1109 IA32_MC21_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Register Address: 456H, 1110 IA32_MC21_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: 457H, 1111 IA32_MC21_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers Used in RAPL Interfaces (R/O) Package 
3:0 Power Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
7:4 Reserved. Package 
12:8 Energy Status Units Package 
Energy related information (in Joules) is based on the multiplier, 1/2*ESU; 
where ESU is an unsigned integer represented by bits 12:8. Default value is 
OEH (or 61 micro-joules). 
15:13 Reserved. Package 
19:16 Time Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
63:20 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
Energy Consumed by DRAM devices. 
31:0 Energy in 15.3 micro-joules. Requires BIOS configuration to enable DRAM 
RAPL mode 0 (Direct VR). 
63:32 Reserved. 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 
DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61€H, 1566 MSR_PCIE_PLL_RATIO 
Configuration of PCIE PLL Relative to BCLK(R/W) Package 
1:0 PCIE Ratio (R/W) Package 
OOb: Use 5:5 mapping for1OOMHz operation (default). 
01b: Use 5:4 mapping for125MHz operation. 
10b: Use 5:3 mapping for166MHz operation. 
11b: Use 5:2 mapping for250MHz operation. 
2 LPLL Select (R/W) Package 
If 1, use configured setting of PCIE Ratio. 
3 LONG RESET (R/W) Package 
If 1, wait an additional time-out before re-locking Gen2/Gen3 PLLs. 
63:4 Reserved. 
Register Address: 620H, 1568 MSR_UNCORE_RATIO_LIMIT 
Uncore Ratio Limit (R/W) Package 
Out of reset, the min_ratio and max_ratio fields represent the widest possible range of uncore frequencies. Writing to 
these fields allows software to control the minimum and the maximum frequency that hardware will select. 
6:0 MAX_RATIO 
This field is used to limit the max ratio of the LLC/Ring. 
7 Reserved. 
14:8 MIN_RATIO 
Writing to this field controls the minimum possible ratio of the LLC/Ring. 
63:15 Reserved. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
Reserved (R/O) Package 


Reads return 0. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 690H, 1680 MSR_CORE_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in Processor Cores (R/W) Package 
(Frequency refers to processor core frequency.) 
0 PROCHOT Status (RO) 


When set, processor core frequency is reduced below the operating system 
request due to assertion of external PROCHOT. 


1 Thermal Status (RO) 


When set, frequency is reduced below the operating system request due to 
a thermal event. 


2 Power Budget Management Status (RO) 


When set, frequency is reduced below the operating system request due to 
PBM limit 


3 Platform Configuration Services Status (RO) 


When set, frequency is reduced below the operating system request due to 
PCS limit 


4 Reserved. 


Autonomous Utilization-Based Frequency Control Status (RO) 


When set, frequency is reduced below the operating system request 
because the processor has detected that utilization is low. 


6 VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system request due to 
a thermal alert from the Voltage Regulator. 


Reserved. 


Electrical Design Point Status (RO) 


When set, frequency is reduced below the operating system request due to 
electrical design point constraints (e.g., maximum electrical current 


consumption). 
9 Reserved. 
10 Multi-Core Turbo Status (RO) 


When set, frequency is reduced below the operating system request due to 
Multi-Core Turbo limits. 


12:11 Reserved. 
13 Core Frequency P1 Status (RO) 

When set, frequency is reduced below max non-turbo P1. 
14 Core Max N-Core Turbo Frequency Limiting Status (RO) 

When set, frequency is reduced below max n-core turbo frequency. 
15 Core Frequency Limiting Status (RO) 

When set, frequency is reduced below the operating system request. 
16 PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 
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Register Information / Bit Fields 


Bit Description 


Scope 


17 


Thermal Log 


When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


18 Power Budget Management Log 
When set, indicates that the PBM Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing O. 

19 Platform Configuration Services Log 
When set, indicates that the PCS Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing O. 

20 Reserved. 

21 Autonomous Utilization-Based Frequency Control Log 
When set, indicates that the AUBFC Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing O. 

22 VR Therm Alert Log 
When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

23 Reserved. 

24 Electrical Design Point Log 
When set, indicates that the EDP Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing O. 

25 Reserved. 

26 Multi-Core Turbo Log 
When set, indicates that the Multi-Core Turbo Status bit has asserted since 
the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

28:27 Reserved. 

29 Core Frequency P1 Log 
When set, indicates that the Core Frequency P1 Status bit has asserted 
since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

30 Core Max N-Core Turbo Frequency Limiting Log 


When set, indicates that the Core Max n-core Turbo Frequency Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
31 Core Frequency Limiting Log 
When set, indicates that the Core Frequency Limiting Status bit has 
asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 
63:32 Reserved. 
Register Address: C8DH, 3213 IA32_QM_EVTSEL 
Monitoring Event Select Register (R/W) Thread 
If CPUID.(EAX=07H, ECX=0):EBX.RDT-M[bit 12] = 1. 
7:0 EventID (R/W) 
Event encoding: 
0x0: No monitoring. 
0x1: L3 occupancy monitoring. 
All other encoding reserved. 
31:8 Reserved. 
41:32 RMID (R/W) 
63:42 Reserved. 
Register Address: C8EH, 3214 IA32_QM_CTR 
Monitoring Counter Register (R/O) Thread 
If CPUID.(EAX=07H, ECX=0):EBX.RDT-M[bit 12] = 1. 
61:0 Resource Monitored Data 
62 Unavailable: If 1, indicates data for this RMID is not available or not 
monitored for this resource or RMID. 
63 Error: If 1, indicates an unsupported RMID or event type was written to 
IA32_PQR_QM_EVTSEL. 
Register Address: C8FH, 3215 IA32_PQR_ASSOC 
Resource Association Register (R/W) Thread 
9:0 RMID 
63:10 Reserved. 


value of O6_3FH. 


See Table 2-20 and Table 2-29 for other MSR definitions applicable to processors with a CPUID Signature DisplayFamily_DisplayModel 


NOTES: 


1. An override configuration lower than the factory-set configuration is always supported. An override configuration higher than the fac- 
tory-set configuration is dependent on features specific to the processor and the platform. 


2.14.1 


Additional Uncore PMU MSRs in the Intel® Xeon® Processor E5 v3 Family 


The Intel Xeon Processor E5 v3 and E7 v3 families are based on Haswell-E microarchitecture. The MSR-based 
uncore PMU interfaces are listed in Table 2-33. For complete details of the uncore PMU, refer to the Intel Xeon 
Processor E5 v3 Product Family Uncore Performance Monitoring Guide. These processors have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_3FH. 
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Register Information / Bit Fields Bit Description Scope 
Register Address: 700H, 1792 MSR_PMON_GLOBAL_CTL 
Uncore Perfmon Per-Socket Global Control Package 
Register Address: 701H, 1793 MSR_PMON_GLOBAL_STATUS 
Uncore Perfmon Per-Socket Global Status Package 
Register Address: 702H, 1794 MSR_PMON_GLOBAL_CONFIG 
Uncore Perfmon Per-Socket Global Configuration Package 
Register Address: 703H, 1795 MSR_U_PMON_UCLK_FIXED_CTL 
Uncore U-Box UCLK Fixed Counter Control Package 
Register Address: 704H, 1796 MSR_U_PMON_UCLK_FIXED_CTR 
Uncore U-Box UCLK Fixed Counter Package 
Register Address: 705H, 1797 MSR_U_PMON_EVNTSELO 
Uncore U-Box Perfmon Event Select for U-Box Counter 0 Package 
Register Address: 706H, 1798 MSR_U_PMON_EVNTSEL1 
Uncore U-Box Perfmon Event Select for U-Box Counter 1 Package 
Register Address: 708H, 1800 MSR_U_PMON_BOX_STATUS 
Uncore U-Box Perfmon U-Box Wide Status Package 
Register Address: 709H, 1801 MSR_U_PMON_CTRO 
Uncore U-Box Perfmon Counter 0 Package 
Register Address: 7OAH, 1802 MSR_U_PMON_CTR1 
Uncore U-Box Perfmon Counter 1 Package 
Register Address: 710H, 1808 MSR_PCU_PMON_BOX_CTL 
Uncore PCU Perfmon for PCU-Box-Wide Control Package 
Register Address: 711H, 1809 MSR_PCU_PMON_EVNTSELO 
Uncore PCU Perfmon Event Select for PCU Counter 0 Package 
Register Address: 712H, 1810 MSR_PCU_PMON_EVNTSEL1 
Uncore PCU Perfmon Event Select for PCU Counter 1 Package 
Register Address: 713H, 1811 MSR_PCU_PMON_EVNTSEL2 
Uncore PCU Perfmon Event Select for PCU Counter 2 Package 
Register Address: 714H, 1812 MSR_PCU_PMON_EVNTSEL3 
Uncore PCU Perfmon Event Select for PCU Counter 3 Package 
Register Address: 715H, 1813 MSR_PCU_PMON_BOX_FILTER 
Uncore PCU Perfmon Box-Wide Filter Package 
Register Address: 716H, 1814 MSR_PCU_PMON_BOX_STATUS 
Uncore PCU Perfmon Box Wide Status Package 
Register Address: 717H, 1815 MSR_PCU_PMON_CTRO 
Uncore PCU Perfmon Counter 0 Package 
Register Address: 718H, 1816 MSR_PCU_PMON_CTR1 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Uncore PCU Perfmon Counter 1 Package 
Register Address: 719H, 1817 MSR_PCU_PMON_CTR2 
Uncore PCU Perfmon Counter 2 Package 
Register Address: 71AH, 1818 MSR_PCU_PMON_CTR3 
Uncore PCU Perfmon Counter 3 Package 
Register Address: 720H, 1824 MSR_SO_PMON_BOX_CTL 
Uncore SBo O Perfmon for SBo 0 Box-Wide Control Package 
Register Address: 721H, 1825 MSR_SO_PMON_EVNTSELO 
Uncore SBo O Perfmon Event Select for SBo O Counter O Package 
Register Address: 722H, 1826 MSR_SO_PMON_EVNTSEL1 
Uncore SBo O Perfmon Event Select for SBo O Counter 1 Package 
Register Address: 723H, 1827 MSR_SO_PMON_EVNTSEL2 
Uncore SBo O Perfmon Event Select for SBo O Counter 2 Package 
Register Address: 724H, 1828 MSR_SO_PMON_EVNTSEL3 
Uncore SBo O Perfmon Event Select for SBo O Counter 3 Package 
Register Address: 725H, 1829 MSR_SO_PMON_BOX_FILTER 
Uncore SBo O Perfmon Box-Wide Filter Package 
Register Address: 726H, 1830 MSR_SO_PMON_CTRO 
Uncore SBo O Perfmon Counter O Package 
Register Address: 727H, 1831 MSR_SO_PMON_CTR1 
Uncore SBo O Perfmon Counter 1 Package 
Register Address: 728H, 1832 MSR_SO_PMON_CTR2 
Uncore SBo O Perfmon Counter 2 Package 
Register Address: 729H, 1833 MSR_SO_PMON_CTR3 
Uncore SBo O Perfmon Counter 3 Package 
Register Address: 72AH, 1834 MSR_S1_PMON_BOX_CTL 
Uncore SBo 1 Perfmon for SBo 1 Box-Wide Control Package 
Register Address: 72BH, 1835 MSR_S1_PMON_EVNTSELO 
Uncore SBo 1 Perfmon Event Select for SBo 1 Counter 0 Package 
Register Address: 72CH, 1836 MSR_S1_PMON_EVNTSEL1 
Uncore SBo 1 Perfmon Event Select for SBo 1 Counter 1 Package 
Register Address: 72DH, 1837 MSR_S1_PMON_EVNTSEL2 
Uncore SBo 1 Perfmon Event Select for SBo 1 Counter 2 Package 
Register Address: 72EH, 1838 MSR_S1_PMON_EVNTSEL3 
Uncore SBo 1 Perfmon Event Select for SBo 1 Counter 3 Package 
Register Address: 72FH, 1839 MSR_S1_PMON_BOX_FILTER 
Uncore SBo 1 Perfmon Box-Wide Filter Package 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 730H, 1840 MSR_S1_PMON_CTRO 
Uncore SBo 1 Perfmon Counter O Package 
Register Address: 731H, 1841 MSR_S1_PMON_CTR1 
Uncore SBo 1 Perfmon Counter 1 Package 
Register Address: 732H, 1842 MSR_S1_PMON_CTR2 
Uncore SBo 1 Perfmon Counter 2 Package 
Register Address: 733H, 1843 MSR_S1_PMON_CTR3 
Uncore SBo 1 Perfmon Counter 3 Package 
Register Address: 734H, 1844 MSR_S2_PMON_BOX_CTL 
Uncore SBo 2 Perfmon for SBo 2 Box-Wide Control Package 
Register Address: 735H, 1845 MSR_S2_PMON_EVNTSELO 
Uncore SBo 2 Perfmon Event Select for SBo 2 Counter 0 Package 
Register Address: 736H, 1846 MSR_S2_PMON_EVNTSEL1 
Uncore SBo 2 Perfmon Event Select for SBo 2 Counter 1 Package 
Register Address: 737H, 1847 MSR_S2_PMON_EVNTSEL2 
Uncore SBo 2 Perfmon Event Select for SBo 2 Counter 2 Package 
Register Address: 738H, 1848 MSR_S2_PMON_EVNTSEL3 
Uncore SBo 2 Perfmon Event Select for SBo 2 Counter 3 Package 
Register Address: 739H, 1849 MSR_S2_PMON_BOX_FILTER 
Uncore SBo 2 Perfmon Box-Wide Filter Package 
Register Address: 73AH, 1850 MSR_S2_PMON_CTRO 
Uncore SBo 2 Perfmon Counter O Package 
Register Address: 73BH, 1851 MSR_S2_PMON_CTR1 
Uncore SBo 2 Perfmon Counter 1 Package 
Register Address: 73CH, 1852 MSR_S2_PMON_CTR2 
Uncore SBo 2 Perfmon Counter 2 Package 
Register Address: 73DH, 1853 MSR_S2_PMON_CTR3 
Uncore SBo 2 Perfmon Counter 3 Package 
Register Address: 73EH, 1854 MSR_S3_PMON_BOX_CTL 
Uncore SBo 3 Perfmon for SBo 3 Box-Wide Control Package 
Register Address: 73FH, 1855 MSR_S3_PMON_EVNTSELO 
Uncore SBo 3 Perfmon Event Select for SBo 3 Counter 0 Package 
Register Address: 740H, 1856 MSR_S3_PMON_EVNTSEL1 
Uncore SBo 3 Perfmon Event Select for SBo 3 Counter 1 Package 
Register Address: 741H, 1857 MSR_S3_PMON_EVNTSEL2 
Uncore SBo 3 Perfmon Event Select for SBo 3 Counter 2 Package 
Register Address: 742H, 1858 MSR_S3_PMON_EVNTSEL3 
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Uncore SBo 3 Perfmon Event Select for SBo 3 Counter 3 Package 
Register Address: 743H, 1859 MSR_S3_PMON_BOX_FILTER 
Uncore SBo 3 Perfmon Box-Wide Filter Package 
Register Address: 744H, 1860 MSR_S3_PMON_CTRO 
Uncore SBo 3 Perfmon Counter O Package 
Register Address: 745H, 1861 MSR_S3_PMON_CTR1 
Uncore SBo 3 Perfmon Counter 1 Package 
Register Address: 746H, 1862 MSR_S3_PMON_CTR2 
Uncore SBo 3 Perfmon Counter 2 Package 
Register Address: 747H, 1863 MSR_S3_PMON_CTR3 
Uncore SBo 3 Perfmon Counter 3 Package 
Register Address: EOOH, 3584 MSR_CO_PMON_BOX_CTL 
Uncore C-Box 0 Perfmon for Box-Wide Control Package 
Register Address: E€01H, 3585 MSR_CO_PMON_EVNTSELO 
Uncore C-Box 0 Perfmon Event Select for C-Box 0 Counter O Package 
Register Address: 02H, 3586 MSR_CO_PMON_EVNTSEL1 
Uncore C-Box 0 Perfmon Event Select for C-Box O Counter 1 Package 
Register Address: E03H, 3587 MSR_CO_PMON_EVNTSEL2 
Uncore C-Box 0 Perfmon Event Select for C-Box 0 Counter 2 Package 
Register Address: E04H, 3588 MSR_CO_PMON_EVNTSEL3 
Uncore C-Box 0 Perfmon Event Select for C-Box 0 Counter 3 Package 
Register Address: E05H, 3589 MSR_CO_PMON_BOX_FILTERO 
Uncore C-Box O Perfmon Box Wide Filter 0 Package 
Register Address: EO6H, 3590 MSR_CO_PMON_BOX_FILTER1 
Uncore C-Box 0 Perfmon Box Wide Filter 1 Package 
Register Address: €07H, 3591 MSR_CO_PMON_BOX_STATUS 
Uncore C-Box 0 Perfmon Box Wide Status Package 
Register Address: E08H, 3592 MSR_CO_PMON_CTRO 
Uncore C-Box 0 Perfmon Counter 0 Package 
Register Address: EOSH, 3593 MSR_CO_PMON_CTR1 
Uncore C-Box 0 Perfmon Counter 1 Package 
Register Address: EQAH, 3594 MSR_CO_PMON_CTR2 
Uncore C-Box 0 Perfmon Counter 2 Package 
Register Address: EOBH, 3595 MSR_CO_PMON_CTR3 
Uncore C-Box 0 Perfmon Counter 3 Package 
Register Address: 10H, 3600 MSR_C1_PMON_BOX_CTL 
Uncore C-Box 1 Perfmon for Box-Wide Control Package 
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Register Address: 11H, 3601 MSR_C1_PMON_EVNTSELO 
Uncore C-Box 1 Perfmon Event Select for C-Box 1 Counter 0 Package 
Register Address: E12H, 3602 MSR_C1_PMON_EVNTSEL1 
Uncore C-Box 1 Perfmon Event Select for C-Box 1 Counter 1 Package 
Register Address: E13H, 3603 MSR_C1_PMON_EVNTSEL2 
Uncore C-Box 1 Perfmon Event Select for C-Box 1 Counter 2 Package 
Register Address: E14H, 3604 MSR_C1_PMON_EVNTSEL3 
Uncore C-Box 1 Perfmon Event Select for C-Box 1 Counter 3 Package 
Register Address: €15H, 3605 MSR_C1_PMON_BOX_FILTERO 
Uncore C-Box 1 Perfmon Box Wide Filter 0 Package 
Register Address: €16H, 3606 MSR_C1_PMON_BOX_FILTER1 
Uncore C-Box 1 Perfmon Box Wide Filter1 Package 
Register Address: 17H, 3607 MSR_C1_PMON_BOX_STATUS 
Uncore C-Box 1 Perfmon Box Wide Status Package 
Register Address: €18H, 3608 MSR_C1_PMON_CTRO 
Uncore C-Box 1 Perfmon Counter O Package 
Register Address: €19H, 3609 MSR_C1_PMON_CTR1 
Uncore C-Box 1 Perfmon Counter 1 Package 
Register Address: €1AH, 3610 MSR_C1_PMON_CTR2 
Uncore C-Box 1 Perfmon Counter 2 Package 
Register Address: €1BH, 3611 MSR_C1_PMON_CTR3 
Uncore C-Box 1 Perfmon Counter 3 Package 
Register Address: E20H, 3616 MSR_C2_PMON_BOX_CTL 
Uncore C-Box 2 Perfmon for Box-Wide Control Package 
Register Address: 21H, 3617 MSR_C2_PMON_EVNTSELO 
Uncore C-Box 2 Perfmon Event Select for C-Box 2 Counter 0 Package 
Register Address: E22H, 3618 MSR_C2_PMON_EVNTSEL1 
Uncore C-Box 2 Perfmon Event Select for C-Box 2 Counter 1 Package 
Register Address: E23H, 3619 MSR_C2_PMON_EVNTSEL2 
Uncore C-Box 2 Perfmon Event Select for C-Box 2 Counter 2 Package 
Register Address: E24H, 3620 MSR_C2_PMON_EVNTSEL3 
Uncore C-Box 2 Perfmon Event select for C-Box 2 Counter 3 Package 
Register Address: E25H, 3621 MSR_C2_PMON_BOX_FILTERO 
Uncore C-Box 2 Perfmon Box Wide Filter 0 Package 
Register Address: E26H, 3622 MSR_C2_PMON_BOX_FILTER1 
Uncore C-Box 2 Perfmon Box Wide Filter1 Package 
Register Address: E27H, 3623 MSR_C2_PMON_BOX_STATUS 


2-294 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-33. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v3 Family (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 2 Perfmon Box Wide Status Package 
Register Address: 28H, 3624 MSR_C2_PMON_CTRO 
Uncore C-Box 2 Perfmon Counter 0 Package 
Register Address: E29H, 3625 MSR_C2_PMON_CTR1 
Uncore C-Box 2 Perfmon Counter 1 Package 
Register Address: E2AH, 3626 MSR_C2_PMON_CTR2 
Uncore C-Box 2 Perfmon Counter 2 Package 
Register Address: E2BH, 3627 MSR_C2_PMON_CTR3 
Uncore C-Box 2 Perfmon Counter 3 Package 
Register Address: E30H, 3632 MSR_C3_PMON_BOX_CTL 
Uncore C-Box 3 Perfmon for Box-Wide Control Package 
Register Address: €31H, 3633 MSR_C3_PMON_EVNTSELO 
Uncore C-Box 3 Perfmon Event Select for C-Box 3 Counter 0 Package 
Register Address: 32H, 3634 MSR_C3_PMON_EVNTSEL1 
Uncore C-Box 3 Perfmon Event Select for C-Box 3 Counter 1 Package 
Register Address: €33H, 3635 MSR_C3_PMON_EVNTSEL2 
Uncore C-Box 3 Perfmon Event Select for C-Box 3 Counter 2 Package 
Register Address: E34H, 3636 MSR_C3_PMON_EVNTSEL3 
Uncore C-Box 3 Perfmon Event Select for C-Box 3 Counter 3 Package 
Register Address: E35H, 3637 MSR_C3_PMON_BOX_FILTERO 
Uncore C-Box 3 Perfmon Box Wide Filter 0 Package 
Register Address: E36H, 3638 MSR_C3_PMON_BOX_FILTER1 
Uncore C-Box 3 Perfmon Box Wide Filter1 Package 
Register Address: 37H, 3639 MSR_C3_PMON_BOX_STATUS 
Uncore C-Box 3 Perfmon Box Wide Status Package 
Register Address: 38H, 3640 MSR_C3_PMON_CTRO 
Uncore C-Box 3 Perfmon Counter O Package 
Register Address: 39H, 3641 MSR_C3_PMON_CTR1 
Uncore C-Box 3 Perfmon Counter 1 Package 
Register Address: E3AH, 3642 MSR_C3_PMON_CTR2 
Uncore C-Box 3 Perfmon Counter 2 Package 
Register Address: E3BH, 3643 MSR_C3_PMON_CTR3 
Uncore C-Box 3 Perfmon Counter 3 Package 
Register Address: E40H, 3648 MSR_C4_PMON_BOX_CTL 
Uncore C-Box 4 Perfmon for Box-Wide Control Package 
Register Address: E41H, 3649 MSR_C4_PMON_EVNTSELO 
Uncore C-Box 4 Perfmon Event Select for C-Box 4 Counter 0 Package 
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Register Address: E42H, 3650 MSR_C4_PMON_EVNTSEL1 
Uncore C-Box 4 Perfmon Event Select for C-Box 4 Counter 1 Package 
Register Address: E43H, 3651 MSR_C4_PMON_EVNTSEL2 
Uncore C-Box 4 Perfmon Event Select for C-Box 4 Counter 2 Package 
Register Address: E44H, 3652 MSR_C4_PMON_EVNTSEL3 
Uncore C-Box 4 Perfmon Event Select for C-Box 4 Counter 3 Package 
Register Address: E45H, 3653 MSR_C4_PMON_BOX_FILTERO 
Uncore C-Box 4 Perfmon Box Wide Filter 0 Package 
Register Address: E46H, 3654 MSR_C4_PMON_BOX_FILTER1 
Uncore C-Box 4 Perfmon Box Wide Filter1 Package 
Register Address: 47H, 3655 MSR_C4_PMON_BOX_STATUS 
Uncore C-Box 4 Perfmon Box Wide Status Package 
Register Address: E48H, 3656 MSR_C4_PMON_CTRO 
Uncore C-Box 4 Perfmon Counter 0 Package 
Register Address: E49H, 3657 MSR_C4_PMON_CTR1 
Uncore C-Box 4 Perfmon Counter 1 Package 
Register Address: E4AH, 3658 MSR_C4_PMON_CTR2 
Uncore C-Box 4 Perfmon Counter 2 Package 
Register Address: E4BH, 3659 MSR_C4_PMON_CTR3 
Uncore C-Box 4 Perfmon Counter 3 Package 
Register Address: E50H, 3664 MSR_C5_PMON_BOX_CTL 
Uncore C-Box 5 Perfmon for Box-Wide Control Package 
Register Address: €51H, 3665 MSR_C5_PMON_EVNTSELO 
Uncore C-Box 5 Perfmon Event Select for C-Box 5 Counter 0 Package 
Register Address: E52H, 3666 MSR_C5_PMON_EVNTSEL1 
Uncore C-Box 5 Perfmon Event Select for C-Box 5 Counter 1 Package 
Register Address: E53H, 3667 MSR_C5_PMON_EVNTSEL2 
Uncore C-Box 5 Perfmon Event Select for C-Box 5 Counter 2 Package 
Register Address: E54H, 3668 MSR_C5_PMON_EVNTSEL3 
Uncore C-Box 5 Perfmon Event Select for C-Box 5 Counter 3 Package 
Register Address: E55H, 3669 MSR_C5_PMON_BOX_FILTERO 
Uncore C-Box 5 Perfmon Box Wide Filter 0 Package 
Register Address: E56H, 3670 MSR_C5_PMON_BOX_FILTER1 
Uncore C-Box 5 Perfmon Box Wide Filter 1 Package 
Register Address: E57H, 3671 MSR_C5_PMON_BOX_STATUS 
Uncore C-Box 5 Perfmon Box Wide Status Package 
Register Address: E58H, 3672 MSR_C5_PMON_CTRO 
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Uncore C-Box 5 Perfmon Counter 0 Package 
Register Address: E59H, 3673 MSR_C5_PMON_CTR1 
Uncore C-Box 5 Perfmon Counter 1 Package 
Register Address: E5AH, 3674 MSR_C5_PMON_CTR2 
Uncore C-Box 5 Perfmon Counter 2 Package 
Register Address: E5BH, 3675 MSR_C5_PMON_CTR3 
Uncore C-Box 5 Perfmon Counter 3 Package 
Register Address: E60H, 3680 MSR_C6_PMON_BOX_CTL 
Uncore C-Box 6 Perfmon for Box-Wide Control Package 
Register Address: €61H, 3681 MSR_C6_PMON_EVNTSELO 
Uncore C-Box 6 Perfmon Event Select for C-Box 6 Counter 0 Package 
Register Address: 62H, 3682 MSR_C6_PMON_EVNTSEL1 
Uncore C-Box 6 Perfmon Event Select for C-Box 6 Counter 1 Package 
Register Address: 63H, 3683 MSR_C6_PMON_EVNTSEL2 
Uncore C-Box 6 Perfmon Event Select for C-Box 6 Counter 2 Package 
Register Address: E64H, 3684 MSR_C6_PMON_EVNTSEL3 
Uncore C-Box 6 Perfmon Event Select for C-Box 6 Counter 3 Package 
Register Address: E65H, 3685 MSR_C6_PMON_BOX_FILTERO 
Uncore C-Box 6 Perfmon Box Wide Filter 0 Package 
Register Address: E66H, 3686 MSR_C6_PMON_BOX_FILTER1 
Uncore C-Box 6 Perfmon Box Wide Filter 1 Package 
Register Address: €67H, 3687 MSR_C6_PMON_BOX_STATUS 
Uncore C-Box 6 Perfmon Box Wide Status Package 
Register Address: E68H, 3688 MSR_C6_PMON_CTRO 
Uncore C-Box 6 Perfmon Counter O Package 
Register Address: E69H, 3689 MSR_C6_PMON_CTR1 
Uncore C-Box 6 Perfmon Counter 1 Package 
Register Address: E6AH, 3690 MSR_C6_PMON_CTR2 
Uncore C-Box 6 Perfmon Counter 2 Package 
Register Address: E6BH, 3691 MSR_C6_PMON_CTR3 
Uncore C-Box 6 Perfmon Counter 3 Package 
Register Address: 70H, 3696 MSR_C7_PMON_BOX_CTL 
Uncore C-Box 7 Perfmon for Box-Wide Control Package 
Register Address: E71H, 3697 MSR_C7_PMON_EVNTSELO 
Uncore C-Box 7 Perfmon Event Select for C-Box 7 Counter 0 Package 
Register Address: E72H, 3698 MSR_C7_PMON_EVNTSEL1 
Uncore C-Box 7 Perfmon Event Select for C-Box 7 Counter 1 Package 
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Register Address: E73H, 3699 MSR_C7_PMON_EVNTSEL2 
Uncore C-Box 7 Perfmon Event Select for C-Box 7 Counter 2 Package 
Register Address: E74H, 3700 MSR_C7_PMON_EVNTSEL3 
Uncore C-Box 7 Perfmon Event Select for C-Box 7 Counter 3 Package 
Register Address: 75H, 3701 MSR_C7_PMON_BOX_FILTERO 
Uncore C-Box 7 Perfmon Box Wide Filter 0 Package 
Register Address: E76H, 3702 MSR_C7_PMON_BOX_FILTER1 
Uncore C-Box 7 Perfmon Box Wide Filter 1 Package 
Register Address: E77H, 3703 MSR_C7_PMON_BOX_STATUS 
Uncore C-Box 7 Perfmon Box Wide Status Package 
Register Address: €78H, 3704 MSR_C7_PMON_CTRO 
Uncore C-Box 7 Perfmon Counter O Package 
Register Address: €79H, 3705 MSR_C7_PMON_CTR1 
Uncore C-Box 7 Perfmon Counter 1 Package 
Register Address: €7AH, 3706 MSR_C7_PMON_CTR2 
Uncore C-Box 7 Perfmon Counter 2 Package 
Register Address: €7BH, 3707 MSR_C7_PMON_CTR3 
Uncore C-Box 7 Perfmon Counter 3 Package 
Register Address: E80H, 3712 MSR_C8_PMON_BOX_CTL 
Uncore C-Box 8 Perfmon Local Box Wide Control Package 
Register Address: E81H, 3713 MSR_C8_PMON_EVNTSELO 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 0 Package 
Register Address: E82H, 3714 MSR_C8_PMON_EVNTSEL1 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 1 Package 
Register Address: E83H, 3715 MSR_C8_PMON_EVNTSEL2 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 2 Package 
Register Address: E84H, 3716 MSR_C8_PMON_EVNTSEL3 
Uncore C-Box 8 Perfmon Event Select for C-Box 8 Counter 3 Package 
Register Address: E85H, 3717 MSR_C8_PMON_BOX_FILTERO 
Uncore C-Box 8 Perfmon Box Wide Filter 0 Package 
Register Address: E86H, 3718 MSR_C8_PMON_BOX_FILTER1 
Uncore C-Box 8 Perfmon Box Wide Filter 1 Package 
Register Address: 87H, 3719 MSR_C8_PMON_BOX_STATUS 
Uncore C-Box 8 Perfmon Box Wide Status Package 
Register Address: €88H, 3720 MSR_C8_PMON_CTRO 
Uncore C-Box 8 Perfmon Counter O Package 
Register Address: E89H, 3721 MSR_C8_PMON_CTR1 
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Uncore C-Box 8 Perfmon Counter 1 Package 
Register Address: E8AH, 3722 MSR_C8_PMON_CTR2 
Uncore C-Box 8 Perfmon Counter 2 Package 
Register Address: E8BH, 3723 MSR_C8_PMON_CTR3 
Uncore C-Box 8 Perfmon Counter 3 Package 
Register Address: E90H, 3728 MSR_C9_PMON_BOX_CTL 
Uncore C-Box 9 Perfmon Local Box Wide Control Package 
Register Address: 91H, 3729 MSR_C9_PMON_EVNTSELO 
Uncore C-Box 9 Perfmon Event Select for C-Box 9 Counter 0 Package 
Register Address: 92H, 3730 MSR_C9_PMON_EVNTSEL1 
Uncore C-Box 9 Perfmon Event Select for C-Box 9 Counter 1 Package 
Register Address: E93H, 3731 MSR_C9_PMON_EVNTSEL2 
Uncore C-Box 9 Perfmon Event Select for C-Box 9 Counter 2 Package 
Register Address: E94H, 3732 MSR_C9_PMON_EVNTSEL3 
Uncore C-Box 9 Perfmon Event Select for C-Box 9 Counter 3 Package 
Register Address: E95H, 3733 MSR_C9_PMON_BOX_FILTERO 
Uncore C-Box 9 Perfmon Box Wide Filter 0 Package 
Register Address: E96H, 3734 MSR_C9_PMON_BOX_FILTER1 
Uncore C-Box 9 Perfmon Box Wide Filter 1 Package 
Register Address: 97H, 3735 MSR_C9_PMON_BOX_STATUS 
Uncore C-Box 9 Perfmon Box Wide Status Package 
Register Address: 98H, 3736 MSR_C9_PMON_CTRO 
Uncore C-Box 9 Perfmon Counter O Package 
Register Address: E9SH, 3737 MSR_C9_PMON_CTR1 
Uncore C-Box 9 Perfmon Counter 1 Package 
Register Address: E9AH, 3738 MSR_C9_PMON_CTR2 
Uncore C-Box 9 Perfmon Counter 2 Package 
Register Address: E9BH, 3739 MSR_C9_PMON_CTR3 
Uncore C-Box 9 Perfmon Counter 3 Package 
Register Address: EAOH, 3744 MSR_C10_PMON_BOX_CTL 
Uncore C-Box 10 Perfmon Local Box Wide Control Package 
Register Address: EA1H, 3745 MSR_C10_PMON_EVNTSELO 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 0 Package 
Register Address: EA2H, 3746 MSR_C10_PMON_EVNTSEL1 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 1 Package 
Register Address: EA3H, 3747 MSR_C10_PMON_EVNTSEL2 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 2 Package 
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Register Address: EA4H, 3748 MSR_C10_PMON_EVNTSEL3 
Uncore C-Box 10 Perfmon Event Select for C-Box 10 Counter 3 Package 
Register Address: EA5H, 3749 MSR_C10_PMON_BOX_FILTERO 
Uncore C-Box 10 Perfmon Box Wide Filter O Package 
Register Address: EAGH, 3750 MSR_C10_PMON_BOX_FILTER1 
Uncore C-Box 10 Perfmon Box Wide Filter 1 Package 
Register Address: EA7H, 3751 MSR_C10_PMON_BOX_STATUS 
Uncore C-Box 10 Perfmon Box Wide Status Package 
Register Address: EA8H, 3752 MSR_C10_PMON_CTRO 
Uncore C-Box 10 Perfmon Counter O Package 
Register Address: EASH, 3753 MSR_C10_PMON_CTR1 
Uncore C-Box 10 perfmon Counter 1 Package 
Register Address: EAAH, 3754 MSR_C10_PMON_CTR2 
Uncore C-Box 10 Perfmon Counter 2 Package 
Register Address: EABH, 3755 MSR_C10_PMON_CTR3 
Uncore C-Box 10 Perfmon Counter 3 Package 
Register Address: EBOH, 3760 MSR_C11_PMON_BOX_CTL 
Uncore C-Box 11 Perfmon Local Box Wide Control Package 
Register Address: EB1H, 3761 MSR_C11_PMON_EVNTSELO 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 0 Package 
Register Address: EB2H, 3762 MSR_C11_PMON_EVNTSEL1 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 1 Package 
Register Address: EB3H, 3763 MSR_C11_PMON_EVNTSEL2 
Uncore C-Box 11 Perfmon Event Select for C-Box 11 Counter 2 Package 
Register Address: EB4H, 3764 MSR_C11_PMON_EVNTSEL3 
Uncore C-box 11 Perfmon Event Select for C-Box 11 Counter 3 Package 
Register Address: EB5H, 3765 MSR_C11_PMON_BOX_FILTERO 
Uncore C-Box 11 Perfmon Box Wide Filter 0 Package 
Register Address: EB6H, 3766 MSR_C11_PMON_BOX_FILTER1 
Uncore C-Box 11 Perfmon Box Wide Filter 1 Package 
Register Address: EB7H, 3767 MSR_C11_PMON_BOX_STATUS 
Uncore C-Box 11 Perfmon Box Wide Status Package 
Register Address: EB8H, 3768 MSR_C11_PMON_CTRO 
Uncore C-Box 11 Perfmon Counter 0 Package 
Register Address: EB9H, 3769 MSR_C11_PMON_CTR1 
Uncore C-Box 11 Perfmon Counter 1 Package 
Register Address: EBAH, 3770 MSR_C11_PMON_CTR2 
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Uncore C-Box 11 Perfmon Counter 2 Package 
Register Address: EBBH, 3771 MSR_C11_PMON_CTR3 
Uncore C-Box 11 Perfmon Counter 3 Package 
Register Address: ECOH, 3776 MSR_C12_PMON_BOX_CTL 
Uncore C-Box 12 Perfmon Local Box Wide Control Package 
Register Address: EC1H, 3777 MSR_C12_PMON_EVNTSELO 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 0 Package 
Register Address: EC2H, 3778 MSR_C12_PMON_EVNTSEL1 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 1 Package 
Register Address: EC3H, 3779 MSR_C12_PMON_EVNTSEL2 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 2 Package 
Register Address: EC4H, 3780 MSR_C12_PMON_EVNTSEL3 
Uncore C-Box 12 Perfmon Event Select for C-Box 12 Counter 3 Package 
Register Address: EC5H, 3781 MSR_C12_PMON_BOX_FILTERO 
Uncore C-Box 12 Perfmon Box Wide Filter 0 Package 
Register Address: EC6H, 3782 MSR_C12_PMON_BOX_FILTER1 
Uncore C-Box 12 Perfmon Box Wide Filter 1 Package 
Register Address: EC7H, 37833783 MSR_C12_PMON_BOX_STATUS 
Uncore C-Box 12 Perfmon Box Wide Status Package 
Register Address: EC8H, 3784 MSR_C12_PMON_CTRO 
Uncore C-Box 12 Perfmon Counter 0 Package 
Register Address: ECSH, 3785 MSR_C12_PMON_CTR1 
Uncore C-Box 12 Perfmon Counter 1 Package 
Register Address: ECAH, 3786 MSR_C12_PMON_CTR2 
Uncore C-Box 12 Perfmon Counter 2 Package 
Register Address: ECBH, 3787 MSR_C12_PMON_CTR3 
Uncore C-Box 12 Perfmon Counter 3 Package 
Register Address: EDOH, 3792 MSR_C13_PMON_BOX_CTL 
Uncore C-Box 13 Perfmon local box wide control. Package 
Register Address: ED1H, 3793 MSR_C13_PMON_EVNTSELO 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 0 Package 
Register Address: ED2H, 3794 MSR_C13_PMON_EVNTSEL1 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 1 Package 
Register Address: ED3H, 3795 MSR_C13_PMON_EVNTSEL2 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 2 Package 
Register Address: ED4H, 3796 MSR_C13_PMON_EVNTSEL3 
Uncore C-Box 13 Perfmon Event Select for C-Box 13 Counter 3 Package 
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Register Address: ED5SH, 3797 MSR_C13_PMON_BOX_FILTERO 
Uncore C-Box 13 Perfmon Box Wide Filter 0 Package 
Register Address: ED6H, 3798 MSR_C13_PMON_BOX_FILTER1 
Uncore C-Box 13 Perfmon Box Wide Filter 1 Package 
Register Address: ED7H, 3799 MSR_C13_PMON_BOX_STATUS 
Uncore C-Box 13 Perfmon Box Wide Status Package 
Register Address: ED8H, 3800 MSR_C13_PMON_CTRO 
Uncore C-Box 13 Perfmon Counter 0 Package 
Register Address: EDSH, 3801 MSR_C13_PMON_CTR1 
Uncore C-Box 13 Perfmon Counter 1 Package 
Register Address: EDAH, 3802 MSR_C13_PMON_CTR2 
Uncore C-Box 13 Perfmon Counter 2 Package 
Register Address: EDBH, 3803 MSR_C13_PMON_CTR3 
Uncore C-Box 13 Perfmon Counter 3 Package 
Register Address: EEQH, 3808 MSR_C14_PMON_BOX_CTL 
Uncore C-Box 14 Perfmon Local Box Wide Control Package 
Register Address: EE1H, 3809 MSR_C14_PMON_EVNTSELO 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 0 Package 
Register Address: EE2H, 3810 MSR_C14_PMON_EVNTSEL1 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 1 Package 
Register Address: EE3H, 3811 MSR_C14_PMON_EVNTSEL2 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 2 Package 
Register Address: EE4H, 3812 MSR_C14_PMON_EVNTSEL3 
Uncore C-Box 14 Perfmon Event Select for C-Box 14 Counter 3 Package 
Register Address: EE5H, 3813 MSR_C14_PMON_BOX_FILTER 
Uncore C-Box 14 Perfmon Box Wide Filter 0 Package 
Register Address: EEGH, 3814 MSR_C14_PMON_BOX_FILTER1 
Uncore C-Box 14 Perfmon Box Wide Filter 1 Package 
Register Address: EE7H, 3815 MSR_C14_PMON_BOX_STATUS 
Uncore C-Box 14 Perfmon Box Wide Status Package 
Register Address: EE8H, 3816 MSR_C14_PMON_CTRO 
Uncore C-Box 14 Perfmon Counter 0 Package 
Register Address: EEQH, 3817 MSR_C14_PMON_CTR1 
Uncore C-Box 14 Perfmon Counter 1 Package 
Register Address: EEAH, 3818 MSR_C14_PMON_CTR2 
Uncore C-Box 14 Perfmon Counter 2 Package 


Register Address: EEBH, 3819 
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Table 2-33. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v3 Family (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 14 Perfmon Counter 3 Package 
Register Address: EFOH, 3824 MSR_C15_PMON_BOX_CTL 
Uncore C-Box 15 Perfmon Local Box Wide Control Package 
Register Address: EF1H, 3825 MSR_C15_PMON_EVNTSELO 
Uncore C-Box 15 Perfmon Event Select for C-Box 15 Counter 0 Package 
Register Address: EF2H, 3826 MSR_C15_PMON_EVNTSEL1 
Uncore C-Box 15 Perfmon Event Select for C-Box 15 Counter 1 Package 
Register Address: EF3H, 3827 MSR_C15_PMON_EVNTSEL2 
Uncore C-Box 15 Perfmon Event Select for C-Box 15 Counter 2 Package 
Register Address: EF4H, 3828 MSR_C15_PMON_EVNTSEL3 
Uncore C-Box 15 Perfmon Event Select for C-Box 15 Counter 3 Package 
Register Address: EF5H, 3829 MSR_C15_PMON_BOX_FILTERO 
Uncore C-Box 15 Perfmon Box Wide Filter 0 Package 
Register Address: EF6H, 3830 MSR_C15_PMON_BOX_FILTER1 
Uncore C-Box 15 Perfmon Box Wide Filter 1 Package 
Register Address: EF7H, 3831 MSR_C15_PMON_BOX_STATUS 
Uncore C-Box 15 Perfmon Box Wide Status Package 
Register Address: EF8H, 3832 MSR_C15_PMON_CTRO 
Uncore C-Box 15 Perfmon Counter 0 Package 
Register Address: EF9H, 3833 MSR_C15_PMON_CTR1 
Uncore C-Box 15 Perfmon Counter 1 Package 
Register Address: EFAH, 3834 MSR_C15_PMON_CTR2 
Uncore C-Box 15 Perfmon Counter 2 Package 
Register Address: EFBH, 3835 MSR_C15_PMON_CTR3 
Uncore C-Box 15 Perfmon Counter 3 Package 
Register Address: FOOH, 3840 MSR_C16_PMON_BOX_CTL 
Uncore C-Box 16 Perfmon for Box-Wide Control Package 
Register Address: FO1H, 3841 MSR_C16_PMON_EVNTSELO 
Uncore C-Box 16 Perfmon Event Select for C-Box 16 Counter O Package 
Register Address: FO2H, 3842 MSR_C16_PMON_EVNTSEL1 
Uncore C-Box 16 Perfmon Event Select for C-Box 16 Counter 1 Package 
Register Address: FO3H, 3843 MSR_C16_PMON_EVNTSEL2 
Uncore C-Box 16 Perfmon Event Select for C-Box 16 Counter 2 Package 
Register Address: FO4H, 3844 MSR_C16_PMON_EVNTSEL3 
Uncore C-Box 16 Perfmon Event Select for C-Box 16 Counter 3 Package 
Register Address: FO5H, 3845 MSR_C16_PMON_BOX_FILTERO 
Uncore C-Box 16 Perfmon Box Wide Filter 0 Package 
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Table 2-33. Uncore PMU MSRs in the Intel® Xeon® Processor E5 v3 Family (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: FO6GH, 3846 MSR_C16_PMON_BOX_FILTER1 
Uncore C-Box 16 Perfmon Box Wide Filter 1 Package 
Register Address: FO7H, 3847 MSR_C16_PMON_BOX_STATUS 
Uncore C-Box 16 Perfmon Box Wide Status Package 
Register Address: FO8H, 3848 MSR_C16_PMON_CTRO 
Uncore C-Box 16 Perfmon Counter 0 Package 
Register Address: FOSH, 3849 MSR_C16_PMON_CTR1 
Uncore C-Box 16 Perfmon Counter 1 Package 
Register Address: FOAH, 3850 MSR_C16_PMON_CTR2 
Uncore C-Box 16 Perfmon Counter 2 Package 
Register Address: FOBH, 3851 MSR_C16_PMON_CTR3 
Uncore C-Box 16 Perfmon Counter 3 Package 
Register Address: F10H, 3856 MSR_C17_PMON_BOX_CTL 
Uncore C-Box 17 Perfmon for Box-Wide Control Package 
Register Address: F11H, 3857 MSR_C17_PMON_EVNTSELO 
Uncore C-Box 17 Perfmon Event Select for C-Box 17 Counter 0 Package 
Register Address: F12H, 3858 MSR_C17_PMON_EVNTSEL1 
Uncore C-Box 17 Perfmon Event Select for C-Box 17 Counter 1 Package 
Register Address: F13H, 3859 MSR_C17_PMON_EVNTSEL2 
Uncore C-Box 17 Perfmon Event Select for C-Box 17 Counter 2 Package 
Register Address: F14H, 3860 MSR_C17_PMON_EVNTSEL3 
Uncore C-Box 17 Perfmon Event Select for C-Box 17 Counter 3 Package 
Register Address: F15H, 3861 MSR_C17_PMON_BOX_FILTERO 
Uncore C-Box 17 Perfmon Box Wide Filter 0 Package 
Register Address: F16H, 3862 MSR_C17_PMON_BOX_FILTER1 
Uncore C-Box 17 Perfmon Box Wide Filter1 Package 
Register Address: F17H, 3863 MSR_C17_PMON_BOX_STATUS 
Uncore C-Box 17 Perfmon Box Wide Status Package 
Register Address: F18H, 3864 MSR_C17_PMON_CTRO 
Uncore C-Box 17 Perfmon Counter O Package 
Register Address: F19H, 3865 MSR_C17_PMON_CTR1 
Uncore C-Box 17 Perfmon Counter 1 Package 
Register Address: F1AH, 3866 MSR_C17_PMON_CTR2 
Uncore C-Box 17 Perfmon Counter 2 Package 
Register Address: F1BH, 3867 MSR_C17_PMON_CTR3 
Uncore C-Box 17 Perfmon Counter 3 Package 


2-304 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


2.15 MSRS IN THE INTEL® CORE™ M PROCESSORS AND THE 5TH GENERATION 
INTEL® CORE™ PROCESSORS 


The Intel® Core™ M-5xxx processors, 5th generation Intel® Core™ Processors, and the Intel® Xeon® Processor 
E3-1200 v4 family are based on Broadwell microarchitecture. The Intel® Core™ M-5xxx processors and 5th gener- 
ation Intel® Core™ Processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_3DH. The Intel® 
Xeon® Processor E3-1200 v4 family and 5th generation Intel® Core™ Processors have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_47H. Processors with a CPUID Signature DisplayFamily_DisplayModel 
value of 06_3DH or 06_47H support the MSR interfaces listed in Table 2-20, Table 2-21, Table 2-22, Table 2-25, 
Table 2-29, Table 2-30, Table 2-34, and Table 2-35. For an MSR listed in Table 2-35 that also appears in the model- 
specific tables of prior generations, Table 2-35 supersedes prior generation tables. 


Table 2-34 lists MSRs that are common to processors based on the Broadwell microarchitectures (including CPUID 
Signature DisplayFamily_DisplayModel values of 06_3DH, 06_47H, 06_4FH, and 06_56H). 


Table 2-34. Additional MSRs Common to Processors Based on Broadwell Microarchitectures 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2 and Section 20.6.2.2, “Global Counter Control Facilities.” Thread 
0 Ovf_PMCO 
1 Ovf_PMC1 
2 Ovf_PMC2 
3 Ovf_PMC3 
31:4 Reserved 
32 Ovf_FixedCtrO 
33 Ovf_FixedCtr1 
34 Ovf_FixedCtr2 
54:35 Reserved. 
55 Trace_ToPA_PMI 

See Section 33.2.7.2, “Table of Physical Addresses (ToPA).” 

60:56 Reserved. 
61 Ovf_Uncore 
62 Ovf_BufDSSAVE 
63 CondChgd 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2 and Section 20.6.2.2, “Global Counter Control Facilities.” Thread 
0 Set 1 to clear Ovf_PMCO. 
1 Set 1 to clear Ovf_PMC1. 
2 Set 1 to clear Ovf_PMC2. 
3 Set 1 to clear Ovf_PMC3. 
31:4 Reserved. 
32 Set 1 to clear Ovf_FixedCtr0. 
33 Set 1 to clear Ovf_FixedCtr1. 
34 Set 1 to clear Ovf_FixedCtr2 
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Table 2-34. Additional MSRs Common to Processors Based on Broadwell Microarchitectures 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
54:35 Reserved. 
55 Set 1 to clear Trace_ToPA_PMI. See Section 33.2.7.2, “Table of Physical 
Addresses (ToPA).” 
60:56 Reserved. 
61 Set 1 to clear Ovf_Uncore. 
62 Set 1 to clear Ovf_BufDSSAVE. 
63 Set 1 to clear CondChad. 
Register Address: 560H, 1376 IA32_RTIT_OUTPUT_BASE 
Trace Output Base Register (R/W) Thread 
6:0 Reserved. 
MAXPHYADDR!-1:7 Base physical address. 
63:MAXPHYADDR Reserved. 
Register Address: 561H, 1377 [A32_RTIT_OUTPUT_MASK_PTRS 
Trace Output Mask Pointers Register (R/W) Thread 
6:0 Reserved. 
31:7 MaskOrTableOffset 
63:32 Output Offset. 
Register Address: 570H, 1392 IA32_RTIT_CTL 
Trace Control Register (R/W) Thread 
0 TraceEn 
1 Reserved, must be zero. 
2 e)s) 
3 User 
6:4 Reserved, must be zero. 
7 CR3Filter 
8 ToPA 
Writing O will #GP if also setting TraceEn. 
9 Reserved, must be zero. 
10 TSCEn 
11 DisRETC 
12 Reserved, must be zero. 
13 Reserved; writing O will #GP if also setting TraceEn. 
63:14 Reserved, must be zero. 
Register Address: 571H, 1393 IA32_RTIT_STATUS 
Tracing Status Register (R/W) Thread 


0 Reserved, writes ignored. 
1 Contex€En, writes ignored. 
2 TriggerEn, writes ignored. 
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Table 2-34. Additional MSRs Common to Processors Based on Broadwell Microarchitectures 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
3 Reserved 
4 Error (R/W) 
5 Stopped 
63:6 Reserved, must be zero. 
Register Address: 572H, 1394 IA32_RTIT_CR3_MATCH 
Trace Filter CR3 Match Register (R/W) Thread 
4:0 Reserved. 
63:5 CR3[63:5] value to match. 
Register Address: 620H, 1568 MSR_UNCORE_RATIO_LIMIT 
Uncore Ratio Limit (R/W) Package 


Out of reset, the min_ratio and max_ratio fields represent the widest possible range of uncore frequencies. Writing to 
these fields allows software to control the minimum and the maximum frequency that hardware will select. 


6:0 MAX_RATIO 
This field is used to limit the max ratio of the LLC/Ring. 
7 Reserved. 
14:8 MIN_RATIO 
Writing to this field controls the minimum possible ratio of the LLC/Ring. 
63:15 Reserved. 
NOTES: 


1. MAXPHYADDR is reported by CPUID.80000008H:EAX[7:0]. 


Table 2-35 lists MSRs that are specific to Intel Core M processors and 5th Generation Intel Core Processors. 


Table 2-35. Additional MSRs Supported by Intel® Core™ M Processors and 5th Generation Intel® Core™ Processors 


Register Address: Hex, Decimal 


Register Name 


ACPI C-states. See http://biosbits.org. 


Register Information / Bit Fields Bit Description Scope 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
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Table 2-35. Additional MSRs Supported by Intel® Core™ M Processors and 5th Generation Intel® Core™ Processors 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
3:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
0000b: CO/C1 (no package C-state support) 
0001b: C2 
001 0b: C3 
001 1b: C6 
0100b: C7 
0101b: C7s 
0110b: C8 
0111b: C9 
1000b: C10 
9:4 Reserved. 
10 I/O MWAIT Redirection Enable (R/W) 
14:11 Reserved. 
15 CFG Lock (R/WO) 
24:16 Reserved. 
25 C3 State Auto Demotion Enable (R/W) 
26 C1 State Auto Demotion Enable (R/W) 
27 Enable C3 Undemotion (R/W) 
28 Enable C1 Undemotion (R/W) 
29 Enable Package C-State Auto-Demotion (R/W) 
30 Enable Package C-State Undemotion (R/W) 
63:31 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Maximum Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO[28] = 1. 
7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 
15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 
23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 
31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 
39:32 Maximum Ratio Limit for 5C Package 
Maximum turbo ratio limit of Score active. 
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Table 2-35. Additional MSRs Supported by Intel® Core™ M Processors and 5th Generation Intel® Core™ Processors 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
47:40 Maximum Ratio Limit for 6C Package 

Maximum turbo ratio limit of Gcore active. 

63:48 Reserved. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
See Table 2-20, Table 2-21, Table 2-22, Table 2-25, Table 2-29, Table 2-30, and Table 2-34 for other MSR definitions applicable to 
processors with a CPUID Signature DisplayFamily_DisplayModel value of O6_3DH. 


2.16 MSRSIN THE INTEL® XEON® PROCESSOR E5 V4 FAMILY 


The MSRs listed in Table 2-36 are available and common to the Intel® Xeon® Processor D Product Family (CPUID 
Signature DisplayFamily_DisplayModel value of 06_56H) and to the Intel Xeon processors E5 v4 and E7 v4 families 
(CPUID Signature DisplayFamily_DisplayModel value of 06_4FH). These processors are based on Broadwell 
microarchitecture. 


See Section 2.16.1 for lists of tables of MSRs that are supported by the Intel® Xeon® Processor D Family. 


Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 4EH, 78 1A32_PPIN_CTL (MSR_PPIN_CTL) 
Protected Processor Inventory Number Enable Control (R/W) Package 
0 LockOut (R/WO) 
See Table 2-2. 
1 Enable_PPIN (R/W) 
See Table 2-2. 
63:2 Reserved 
Register Address: 4FH, 79 IA32_PPIN (MSR_PPIN) 
Protected Processor Inventory Number (R/O) Package 
63:0 Protected Processor Inventory Number (R/O) 
See Table 2-2. 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
See Table 2-26. 
22:16 Reserved. 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
23 PPIN_CAP (R/O) Package 
See Table 2-26. 
27:24 Reserved. 
28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
See Table 2-26. 
29 Programmable TDP Limit for Turbo Mode (R/O) Package 
See Table 2-26. 
30 Programmable T] OFFSET (R/O) Package 
See Table 2-26. 
39:31 Reserved. 
47:40 Maximum Efficiency Ratio (R/O) Package 
See Table 2-26. 
63:48 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. See http://biosbits.org. 
2:0 Package C-State Limit (R/W) 


Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 


The following C-state code name encodings are supported: 

O000b: CO/C1 (no package C-state support) 

001b: C2 

010b: C6 (non-retention) 

011b: C6 (retention) 

111b: No Package C state limits. All C states supported by the processor 


are available. 

9:3 Reserved. 

10 I/O MWAIT Redirection Enable (R/W) 

14:11 Reserved. 

15 CFG Lock (R/WO) 

16 Automatic C-State Conversion Enable (R/W) 
If 1, the processor will convert HALT or MWAT(C1) to MWAIT(C6). 

24:17 Reserved. 

25 C3 State Auto Demotion Enable (R/W) 

26 C1 State Auto Demotion Enable (R/W) 

27 Enable C3 Undemotion (R/W) 

28 Enable C1 Undemotion (R/W) 

29 Package C State Demotion Enable (R/W) 


2-310 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 


Based on Broadwell Microarchitecture (Contd.) 


See Table 2-2. 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
30 Package C State Undemotion Enable (R/W) 
63:31 Reserved. 
Register Address: 1 79H, 377 IA32_MCG_CAP 
Global Machine Check Capability (R/O) Thread 
7:0 Count 
8 MCG_CTL_P 
9 MCG_EXT_P 
10 MCP_CMCI_P 
11 MCG_TES_P 
15:12 Reserved 
23:16 MCG_EXT_CNT 
24 MCG_SER_P 
25 MCG_EM_P 
26 MCG_ELOG_P 
63:27 Reserved. 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Thread 
Reports SMM capability Enhancement. Accessible only while in SMM. 
57:0 Reserved. 
58 SMM_Code_Access_Chk (SMM-RO) 
If set to 1, indicates that the SMM code access restriction is supported and 
a host-space interface available to SMM handler. 
59 Long_Flow_Indication (SMM-RO) 
If set to 1, indicates that the SMM long flow indicator is supported and a 
host-space interface available to SMM handler. 
63:60 Reserved. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Core 


0 


Thermal Status (R/O) 
See Table 2-2. 


Thermal Status Log (R/WCO) 
See Table 2-2. 


PROTCHOT # or FORCEPR# Status (R/O) 
See Table 2-2. 


PROTCHOT # or FORCEPR# Log (R/WCO) 
See Table 2-2. 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 

4 Critical Temperature Status (R/O) 
See Table 2-2. 

5 Critical Temperature Status Log (R/WCO) 
See Table 2-2. 

6 Thermal Threshold #1 Status (R/O) 
See Table 2-2. 

7 Thermal Threshold #1 Log (R/WCO) 
See Table 2-2. 

8 Thermal Threshold #2 Status (R/O) 
See Table 2-2. 

9 Thermal Threshold #2 Log (R/WCO) 
See Table 2-2. 

10 Power Limitation Status (R/O) 
See Table 2-2. 

11 Power Limitation Log (R/WCO) 
See Table 2-2. 

12 Current Limit Status (R/O) 
See Table 2-2. 

13 Current Limit Log (R/WCO) 
See Table 2-2. 

14 Cross Domain Limit Status (R/O) 
See Table 2-2. 

15 Cross Domain Limit Log (R/WCO) 
See Table 2-2. 

22:16 Digital Readout (R/O) 
See Table 2-2. 

26:23 Reserved. 

30:27 Resolution in Degrees Celsius (R/O) 
See Table 2-2. 

31 Reading Valid (R/O) 
See Table 2-2. 

63:32 Reserved. 

Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 

Temperature Target Package 

15:0 Reserved. 

23:16 Temperature Target (R/O) 
See Table 2-26. 

27:24 TCC Activation Offset (R/W) 
See Table 2-26. 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
63:28 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Maximum Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 
7:0 Maximum Ratio Limit for 1C Package 
15:8 Maximum Ratio Limit for 2C Package 
23:16 Maximum Ratio Limit for 3C Package 
31:24 Maximum Ratio Limit for 4C Package 
39:32 Maximum Ratio Limit for 5C Package 
47:40 Maximum Ratio Limit for 6C Package 
55:48 Maximum Ratio Limit for 7C Package 
63:56 Maximum Ratio Limit for 8C Package 
Register Address: 1 AEH, 430 MSR_TURBO_RATIO_LIMIT1 
Maximum Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 
7:0 Maximum Ratio Limit for 9C Package 
15:8 Maximum Ratio Limit for 10C Package 
23:16 Maximum Ratio Limit for 11C Package 
31:24 Maximum Ratio Limit for 12C Package 
39:32 Maximum Ratio Limit for 13C Package 
47:40 Maximum Ratio Limit for 14C Package 
55:48 Maximum Ratio Limit for 15C Package 
63:56 Maximum Ratio Limit for 16C Package 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers Used in RAPL Interfaces (R/O) Package 
3:0 Power Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
7:4 Reserved. Package 
12:8 Energy Status Units Package 
Energy related information (in Joules) is based on the multiplier, 1/2*ESU; 
where ESU is an unsigned integer represented by bits 12:8. Default value 
is OEH (or 61 micro-joules). 
15:13 Reserved. Package 
19:16 Time Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
63:20 Reserved. 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 

Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
Energy consumed by DRAM devices. 
31:0 Energy in 15.3 micro-joules. Requires BIOS configuration to enable DRAM 
RAPL mode 0 (Direct VR). 
63:32 Reserved. 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 


See Section 15.10.5, “DRAM RAPL Domain.” 


Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 


DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 

Register Address: 620H, 1568 MSR_UNCORE_RATIO_LIMIT 

Uncore Ratio Limit (R/W) Package 


Out of reset, the min_ratio and max_ratio fields represent the widest possible range of uncore frequencies. Writing 
to these fields allows software to control the minimum and the maximum frequency that hardware will select. 


63:15 Reserved. 


14:8 MIN_RATIO 
Writing to this field controls the minimum possible ratio of the LLC/Ring. 


Reserved. 
6:0 MAX_RATIO 
This field is used to limit the max ratio of the LLC/Ring. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
Reserved (R/O) Package 


Reads return 0. 


Register Address: 690H, 1680 MSR_CORE_PERF_LIMIT_REASONS 


Indicator of Frequency Clipping in Processor Cores (R/W) Package 
(Frequency refers to processor core frequency.) 
0 PROCHOT Status (RO) 


When set, processor core frequency is reduced below the operating 
system request due to assertion of external PROCHOT. 


1 Thermal Status (RO) 


When set, frequency is reduced below the operating system request due 
to a thermal event. 


2 Power Budget Management Status (RO) 


When set, frequency is reduced below the operating system request due 
to PBM limit. 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 


Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Platform Configuration Services Status (RO) 


When set, frequency is reduced below the operating system request due 
to PCS limit. 


Reserved. 


Autonomous Utilization-Based Frequency Control Status (RO) 


When set, frequency is reduced below the operating system request 
because the processor has detected that utilization is low. 


VR Therm Alert Status (RO) 


When set, frequency is reduced below the operating system request due 
to a thermal alert from the Voltage Regulator. 


Reserved. 


Electrical Design Point Status (RO) 


When set, frequency is reduced below the operating system request due 
to electrical design point constraints (e.g., maximum electrical current 
consumption). 


Reserved. 


Multi-Core Turbo Status (RO) 


When set, frequency is reduced below the operating system request due 
to Multi-Core Turbo limits. 


12:11 


Reserved. 


Core Frequency P1 Status (RO) 
When set, frequency is reduced below max non-turbo P1. 


Core Max N-Core Turbo Frequency Limiting Status (RO) 
When set, frequency is reduced below max n-core turbo frequency. 


Core Frequency Limiting Status (RO) 
When set, frequency is reduced below the operating system request. 
PROCHOT Log 


When set, indicates that the PROCHOT Status bit has asserted since the 
log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


Thermal Log 


When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


Power Budget Management Log 


When set, indicates that the PBM Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing O. 


Platform Configuration Services Log 


When set, indicates that the PCS Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing 0. 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
20 Reserved. 
21 Autonomous Utilization-Based Frequency Control Log 


When set, indicates that the AUBFC Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


22 VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


23 Reserved. 


24 Electrical Design Point Log 


When set, indicates that the EDP Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing O. 


25 Reserved. 


26 Multi-Core Turbo Log 


When set, indicates that the Multi-Core Turbo Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


28:27 Reserved. 


29 Core Frequency P1 Log 


When set, indicates that the Core Frequency P1 Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


30 Core Max N-Core Turbo Frequency Limiting Log 


When set, indicates that the Core Max n-core Turbo Frequency Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


31 Core Frequency Limiting Log 


When set, indicates that the Core Frequency Limiting Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


63:32 Reserved. 

Register Address: 770H, 1904 IA32_PM_ENABLE 

See Section 15.4.2, “Enabling HWP.” Package 
Register Address: 771H, 1905 IA32_HWP_CAPABILITIES 

See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities.” Thread 
Register Address: 774H, 1908 IA32_HWP_REQUEST 

See Section 15.4.4, “Managing HWP.” Thread 
7:0 Minimum Performance (R/W) 

15:8 Maximum Performance (R/W) 


2-316 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
23:16 Desired Performance (R/W) 
63:24 Reserved. 
Register Address: 777H, 1911 IA32_HWP_STATUS 
See Section 15.4.5, “HWP Feedback.” Thread 
1:0 Reserved. 
2 Excursion to Minimum (R/O) 
63:3 Reserved. 
Register Address: C8DH, 3213 IA32_QM_EVTSEL 
Monitoring Event Select Register (R/W) Thread 
If CPUID.(EAX=07H, ECX=0):€BX.RDT-M[bit 12] = 1. 
7:0 EventID (R/W) 
Event encoding: 
0x00: No monitoring. 
0x01: L3 occupancy monitoring. 
OxO2: Total memory bandwidth monitoring. 
0x03: Local memory bandwidth monitoring. 
All other encoding reserved. 
31:8 Reserved. 
41:32 RMID (R/W) 
63:42 Reserved. 
Register Address: C8FH, 3215 IA32_PQR_ASSOC 
Resource Association Register (R/W) Thread 
9:0 RMID 
31:10 Reserved. 
51:32 COS (R/W) 
63:52 Reserved. 
Register Address: CSOH, 3216 IA32_L3_QO0S_MASK_0O 
L3 Class Of Service Mask - COS 0 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=0. 
0:19 CBM: Bit vector of available L3 ways for COS O enforcement. 
63:20 Reserved. 
Register Address: C91H, 3217 IA32_L3_QOS_MASK_1 
L3 Class Of Service Mask - COS 1 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=1. 
0:19 CBM: Bit vector of available L3 ways for COS 1 enforcement. 
63:20 Reserved. 
Register Address: C92H, 3218 IA32_L3_QOS_MASK_2 
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Table 2-36. Additional MSRs Common to the Intel® Xeon® Processor D and the Intel® Xeon® Processor E5 v4 Family 
Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
L3 Class Of Service Mask - COS 2 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=2. 

0:19 CBM: Bit vector of available L3 ways for COS 2 enforcement. 

63:20 Reserved. 

Register Address: C93H, 3219 IA32_L3_QOS_MASK_3 

L3 Class Of Service Mask - COS 3 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=3. 

0:19 CBM: Bit vector of available L3 ways for COS 3 enforcement. 

63:20 Reserved. 

Register Address: C94H, 3220 IA32_L3_QO0S_MASK_4 

L3 Class Of Service Mask - COS 4 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=4. 

0:19 CBM: Bit vector of available L3 ways for COS 4 enforcement. 

63:20 Reserved. 

Register Address: C95H, 3221 IA32_L3_QO0S_MASK_5 

L3 Class Of Service Mask - COS 5 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=5. 

0:19 CBM: Bit vector of available L3 ways for COS 5 enforcement. 

63:20 Reserved. 

Register Address: C96H, 3222 IA32_L3_QOS_MASK_6 

L3 Class Of Service Mask - COS 6 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=6. 

0:19 CBM: Bit vector of available L3 ways for COS 6 enforcement. 

63:20 Reserved. 

Register Address: C97H, 3223 IA32_L3_QOS_MASK_7 

L3 Class Of Service Mask - COS 7 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=7. 

0:19 CBM: Bit vector of available L3 ways for COS 7 enforcement. 

63:20 Reserved. 

Register Address: C98H, 3224 IA32_L3_QOS_MASK_8 

L3 Class Of Service Mask - COS 8 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=8. 

0:19 CBM: Bit vector of available L3 ways for COS 8 enforcement. 

63:20 Reserved. 

Register Address: C99H, 3225 IA32_L3_QOS_MASK_9 

L3 Class Of Service Mask - COS 9 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=9. 

0:19 CBM: Bit vector of available L3 ways for COS 9 enforcement. 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Based on Broadwell Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
63:20 Reserved. 
Register Address: CQAH, 3226 IA32_L3_QOS_MASK_10 
L3 Class Of Service Mask - COS 10 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=10. 
0:19 CBM: Bit vector of available L3 ways for COS 10 enforcement. 
63:20 Reserved. 
Register Address: COBH, 3227 IA32_L3_QOS_MASK_11 
L3 Class Of Service Mask - COS 11 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=11. 
0:19 CBM: Bit vector of available L3 ways for COS 11 enforcement. 
63:20 Reserved. 
Register Address: CSCH, 3228 IA32_L3_QOS_MASK_12 
L3 Class Of Service Mask - COS 12 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=12. 
0:19 CBM: Bit vector of available L3 ways for COS 12 enforcement. 
63:20 Reserved. 
Register Address: CSDH, 3229 IA32_L3_QOS_MASK_13 
L3 Class Of Service Mask - COS 13 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=13. 
0:19 CBM: Bit vector of available L3 ways for COS 13 enforcement. 
63:20 Reserved. 
Register Address: CSEH, 3230 IA32_L3_QOS_MASK_14 
L3 Class Of Service Mask - COS 14 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=14. 
0:19 CBM: Bit vector of available L3 ways for COS 14 enforcement. 
63:20 Reserved. 
Register Address: C9FH, 3231 IA32_L3_QOS_MASK_15 
L3 Class Of Service Mask - COS 15 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=15. 
0:19 CBM: Bit vector of available L3 ways for COS 15 enforcement. 
63:20 Reserved. 
2.16.1 Additional MSRs Supported in the Intel® Xeon® Processor D Product Family 


The MSRs listed in Table 2-37 are available to Intel® Xeon® Processor D Product Family (CPUID Signature 
DisplayFamily_DisplayModel value of 06_56H). The Intel® Xeon® processor D product family is based on Broadwell 
microarchitecture and supports the MSR interfaces listed in Table 2-20, Table 2-29, Table 2-34, Table 2-36, and 
Table 2-37. 
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Table 2-37. Additional MSRs Supported by Intel® Xeon® Processor D with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_56H 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 1ACH, 428 MSR_TURBO_RATIO_LIMIT3 
Config Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 
62:0 Reserved. Package 
63 Semaphore for Turbo Ratio Limit Configuration Package 
If 1, the processor uses override configuration! specified in 
MSR_TURBO_RATIO_LIMIT, MSR_TURBO_RATIO_LIMIT1. 
If O, the processor uses factory-set configuration (Default). 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 
See Table 2-2. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 
See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 
See Table 2-2. Package 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 418H, 1048 IA32_MC6_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC6 reports MC errors from the integrated I/O module. 
Register Address: 419H, 1049 1A32_MC6_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC6 reports MC errors from the integrated I/O module. 
Register Address: 41AH, 1050 IA32_MC6_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC6 reports MC errors from the integrated I/O module. 
Register Address: 41BH, 1051 IA32_MC6_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC6 reports MC errors from the integrated I/O module. 
Register Address: 41CH, 1052 IA32_MC7_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC7 reports MC errors from the home agent HA 0. 
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Table 2-37. Additional MSRs Supported by Intel® Xeon® Processor D with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_56H 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


IA32_MC7_STATUS 


Register Address: 41DH, 1053 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC7 reports MC errors from the home agent HA 0. 


Package 


Register Address: 41€H, 1054 


IA32_MC7_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC7 reports MC errors from the home agent HA 0. 


Package 


Register Address: 41FH, 1055 


IA32_MC7_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC7 reports MC errors from the home agent HA 0. 


Package 


Register Address: 424H, 1060 


IA32_MC9_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 425H, 1061 


IA32_MC9_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,”" through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 426H, 1062 


IA32_MC9_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 427H, 1063 


IA32_MC9_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 428H, 1064 


IA32_MC10_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 429H, 1065 


IA32_MC10_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 42AH, 1066 


IA32_MC10_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 42BH, 1067 


IA32_MC10_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 10 report MC err 


ors from each channel of the integrated memory controllers. 


Package 


Register Address: 444H, 1092 


IA32_MC17_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 


CBo1 2, CBo15. 


Package 


Register Address: 445H, 1093 


IA32_MC17_STATUS 
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Table 2-37. Additional MSRs Supported by Intel® Xeon® Processor D with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_56H 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Package 


Register Address: 446H, 1094 IA32_MC17_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Package 


Register Address: 447H, 1095 IA32_MC17_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Package 


Register Address: 448H, 1096 IA32_MC18_CTL 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 

CBo10, CBo13, CBo16. 

Register Address: 449H, 1097 IA32_MC18_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 44AH, 1098 IA32_MC18_ADDR 


Package 


Register Address: 44BH, 1099 IA32_MC18_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Package 


Register Address: 44CH, 1100 IA32_MC19_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Package 


Register Address: 44DH, 1101 IA32_MC19_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Package 


Register Address: 44EH, 1102 IA32_MC19_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Package 


Register Address: 44FH, 1103 IA32_MC19_MISC 
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Table 2-37. Additional MSRs Supported by Intel® Xeon® Processor D with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_56H 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, "IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


See Table 2-20, Table 2-29, Table 2-34, and Table 2-36 for other MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_56H. 
NOTES: 


1. An override configuration lower than the factory-set configuration is always supported. An override configuration higher than the 
factory-set configuration is dependent on features specific to the processor and the platform. 


2.16.2 Additional MSRs Supported in Intel® Xeon® Processors E5 v4 and E7 v4 Families 


The MSRs listed in Table 2-37 are available to the Intel® Xeon® Processor E5 v4 and E7 v4 Families (CPUID 
Signature DisplayFamily_DisplayModel value of 06_4FH). The Intel® Xeon® processor E5 v4 family is based on 
Broadwell microarchitecture and supports the MSR interfaces listed in Table 2-20, Table 2-21, Table 2-29, Table 
2-34, Table 2-36, and Table 2-38. 


Table 2-38. Additional MSRs Supported by Intel® Xeon® Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_4FH 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 1ACH, 428 MSR_TURBO_RATIO_LIMIT3 
Config Ratio Limit of Turbo Mode Package 
R/O if MSR_PLATFORM_INFO.[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1. 
62:0 Reserved. Package 
63 Semaphore for Turbo Ratio Limit Configuration Package 


If 1, the processor uses override configuration! specified in 
MSR_TURBO_RATIO_LIMIT, MSR_TURBO_RATIO_LIMIT1, and 
MSR_TURBO_RATIO_LIMIT2. 


If O, the processor uses factory-set configuration (Default). 


Register Address: 285H, 645 IA32_MC5_CTL2 

See Table 2-2. Package 
Register Address: 286H, 646 IA32_MC6_CTL2 

See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 

See Table 2-2. Package 
Register Address: 288H, 648 IA32_MC8_CTL2 

See Table 2-2. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 

See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 

See Table 2-2. Package 
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Table 2-38. Additional MSRs Supported by Intel® Xeon® Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_4FH 


Register Address: Hex, Decimal 


Register Name 


Bank MC6 reports MC errors from the int 


egrated I/O module. 


Register Information / Bit Fields Bit Description Scope 
Register Address: 28BH, 651 IA32_MC11_CTL2 
See Table 2-2. Package 
Register Address: 28CH, 652 IA32_MC12_CTL2 
See Table 2-2. Package 
Register Address: 28DH, 653 IA32_MC13_CTL2 
See Table 2-2. Package 
Register Address: 28H, 654 IA32_MC14_CTL2 
See Table 2-2. Package 
Register Address: 28FH, 655 IA32_MC15_CTL2 
See Table 2-2. Package 
Register Address: 290H, 656 IA32_MC16_CTL2 
See Table 2-2. Package 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 294H, 660 IA32_MC20_CTL2 
See Table 2-2. Package 
Register Address: 295H, 661 IA32_MC21_CTL2 
See Table 2-2. Package 
Register Address: 414H, 1044 IA32_MC5_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC5 reports MC errors from the Intel QPI O module. 
Register Address: 415H, 1045 IA32_MC5_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC5 reports MC errors from the Intel QPI O module. 
Register Address: 416H, 1046 IA32_MC5_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC5 reports MC errors from the Intel QPI O module. 
Register Address: 41 7H, 1047 IA32_MC5_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC5 reports MC errors from the Intel QPI O module. 
Register Address: 418H, 1048 IA32_MC6_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 419H, 1049 


IA32_MC6_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC6 reports MC errors from the integrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41AH, 1050 


IA32_MC6_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC6 reports MC errors from the integrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41BH, 1051 


IA32_MC6_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC6 reports MC errors from the integrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41CH, 1052 


IA32_MC7_CTL 


Bank MC7 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 0. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41DH, 1053 


IA32_MC7_STATUS 


Bank MC7 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 0. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41€H, 1054 


IA32_MC7_ADDR 


Bank MC7 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 0. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41FH, 1055 


IA32_MC7_MISC 


Bank MC7 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 0. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 420H, 1056 


IA32_MC8_CTL 


Bank MC8 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 1. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 421H, 1057 


IA32_MC8_STATUS 


Bank MC8 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 1. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 422H, 1058 


IA32_MC8_ADDR 


Bank MC8 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 1. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 423H, 1059 


IA32_MC8_MISC 


Bank MC8 reports MC errors from the ho 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 


me agent HA 1. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 424H, 1060 


IA32_MC9_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 425H, 1061 IA32_MC9_STATUS 


Vol.4 2-325 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-38. Additional MSRs Supported by Intel® Xeon® Processors with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_4FH 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 426H, 1062 IA32_MC9_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 427H, 1063 IA32_MC9_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 428H, 1064 IA32_MC10_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 429H, 1065 IA32_MC10_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs," through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 42AH, 1066 IA32_MC10_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 42BH, 1067 IA32_MC10_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 42CH, 1068 IA32_MC11_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Package 


Register Address: 42DH, 1069 IA32_MC11_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 42EH, 1070 


IA32_MC11_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 42FH, 1071 


IA32_MC11_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 430H, 1072 


IA32_MC12_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 431H, 1073 


IA32_MC12_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MS 


Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Rs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 432H, 1074 IA32_MC12_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 433H, 1075 IA32_MC12_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 434H, 1076 IA32_MC13_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 435H, 1077 IA32_MC13_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 436H, 1078 IA32_MC13_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 437H, 1079 IA32_MC13_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 438H, 1080 IA32_MC14_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 439H, 1081 IA32_MC14_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43AH, 1082 IA32_MC14_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43BH, 1083 IA32_MC14_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43CH, 1084 IA32_MC15_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43DH, 1085 IA32_MC15_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 


Register Address: 43E€H, 1086 IA32_MC15_ADDR 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 43FH, 1087 IA32_MC15_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 440H, 1088 IA32_MC16_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 441H, 1089 IA32_MC16_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 442H, 1090 IA32_MC16_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 443H, 1091 IA32_MC16_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 through MC 16 report MC errors from each channel of the integrated memory controllers. 
Register Address: 444H, 1092 IA32_MC17_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 445H, 1093 IA32_MC17_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 446H, 1094 IA32_MC17_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 447H, 1095 IA32_MC17_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC17 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBoO, CBo3, CBo6, CBo9, 
CBo12, CBo15. 


Register Address: 448H, 1096 IA32_MC18_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Register Address: 449H, 1097 IA32_MC18_STATUS 
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DisplayFamily_DisplayModel Value of 06_4FH 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Package 


Register Address: 44AH, 1098 IA32_MC18_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Package 


Register Address: 44BH, 1099 IA32_MC18_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC18 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo1, CBo4, CBo7, 
CBo10, CBo13, CBo16. 


Package 


Register Address: 44CH, 1100 IA32_MC19_CTL 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 

CBo11, CBo14, CBo17. 

Register Address: 44DH, 1101 IA32_MC19_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Register Address: 44EH, 1102 IA32_MC19_ADDR 


Package 


Register Address: 44FH, 1103 IA32_MC19_ MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Bank MC19 reports MC errors from the following pair of CBo/L3 Slices (if the pair is present): CBo2, CBo5, CBo8, 
CBo11, CBo14, CBo17. 


Package 


Register Address: 450H, 1104 IA32_MC20_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC20 reports MC errors from the Intel QPI 1 module. 


Package 


Register Address: 451H, 1105 IA32_MC20_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC20 reports MC errors from the Intel QPI 1 module. 


Package 


Register Address: 452H, 1106 IA32_MC20_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC20 reports MC errors from the Intel QPI 1 module. 


Package 


Register Address: 453H, 1107 IA32_MC20_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC20 reports MC errors from the Intel QPI 1 module. 


Package 


Register Address: 454H, 1108 IA32_MC21_CTL 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: 455H, 1109 IA32_MC21_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: 456H, 1110 IA32_MC21_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: 457H, 1111 IA32_MC21_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC21 reports MC errors from the Intel QPI 2 module. 
Register Address: C81H, 3201 IA32_L3_QOS_CFG 
Cache Allocation Technology Configuration (R/W) Package 
0 CAT Enable. Set 1 to enable Cache Allocation Technology. 
63:1 Reserved. 


See Table 2-20, Table 2-21, Table 2-29, and Table 2-30 for other MSR definitions applicable to processors with a CPUID Signature 
DisplayFamily_DisplayModel value of O6_45H. 


NOTES: 


1. An override configuration lower than the factory-set configuration is always supported. An override configuration higher than the fac- 
tory-set configuration is dependent on features specific to the processor and the platform. 


2.17  MSRS IN THE 6TH—13TH GENERATION INTEL® CORE™ PROCESSORS, 
1ST—5TH GENERATION INTEL® XEON® SCALABLE PROCESSOR FAMILIES, 
INTEL® CORE™ ULTRA 7 PROCESSORS, 8TH GENERATION INTEL® CORE™ 13 
PROCESSORS, AND INTEL® XEON® € PROCESSORS 


6th generation Intel® Core™ processors are based on Skylake microarchitecture and have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_4EH or 06_5EH. 


The Intel® Xeon® Scalable Processor Family based on the Skylake microarchitecture, the 2nd generation Intel® 
Xeon® Scalable Processor Family based on the Cascade Lake product, and the 3rd generation Intel® Xeon® Scal- 
able Processor Family based on the Cooper Lake product all have a CPUID Signature DisplayFamily_DisplayModel 
value of 06_55H. 


7th generation Intel® Core™ processors are based on the Kaby Lake microarchitecture, 8th generation and 9th 
generation Intel® Core™ processors, and Intel® Xeon® E processors are based on Coffee Lake microarchitecture; 
these processors have a CPUID Signature DisplayFamily_DisplayModel value of 06_8EH or 06_9EH. 


8th generation Intel® Core™ i3 processors are based on Cannon Lake microarchitecture and have a CPUID Signa- 
ture DisplayFamily_DisplayModel value of 06_66H. 


10th generation Intel® Core™ processors are based on Comet Lake microarchitecture (with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_A5H or 06_A6H) and Ice Lake microarchitecture (with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_7DH or 06_7EH). 
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11th generation Intel® Core™ processors are based on Tiger Lake microarchitecture and have a CPUID Signature 
DisplayFamily_DisplayModel value of 06_8CH or 06_8DH. 


The 3rd generation Intel® Xeon® Scalable Processor Family is based on Ice Lake microarchitecture and has a 
CPUID Signature DisplayFamily_DisplayModel value of 06_6AH or 06_6CH. 


12th generation Intel® Core™ processors supporting the Alder Lake performance hybrid architecture have a CPUID 
Signature DisplayFamily_DisplayModel value of 06_97H or 06_9AH. 


13th generation Intel® Core™ processors supporting the Raptor Lake performance hybrid architecture have a 
CPUID Signature DisplayFamily_DisplayModel value of 06_BAH, 06_B7H, or 06_BFH. 


The 4th generation Intel® Xeon® Scalable Processor Family is based on Sapphire Rapids microarchitecture and has 
a CPUID Signature DisplayFamily_DisplayModel value of 06_8FH. 


The 5th generation Intel® Xeon® Scalable Processor Family is based on Emerald Rapids microarchitecture and has 
a CPUID Signature DisplayFamily_DisplayModel value of 06_CFH. 


The Intel® Core™ Ultra 7 processor is based on Meteor Lake hybrid architecture and has a CPUID Signature 
DisplayFamily_DisplayModel value of 06_AAH. 


These processors support the MSR interfaces listed in Table 2-20, Table 2-21, Table 2-25, Table 2-29, Table 2-35, 
and Table 2-391. For an MSR listed in Table 2-39 that also appears in the model-specific tables of prior generations, 
Table 2-39 supersede prior generation tables. 


Tables 2-40 through 2-52 list additional supported MSR interfaces for specific processors; see each table for addi- 
tional details. 


The notation of “Platform” in the Scope column (with respect to MSR_PLATFORM_ENERGY_COUNTER and 


MSR_PLATFORM_POWER_LIMIT) is limited to the power-delivery domain and the specifics of the power delivery 
integration may vary by platform vendor’s implementation. 


Table 2-39. Additional MSRs Supported by the 6th—13th Generation Intel® Core™ Processors, 1st—5th Generation 
Intel® Xeon® Scalable Processor Families, Intel’ Core™ Ultra 7 Processors, 8th Generation Intel® Core™ i3 Processors, 
and Intel® Xeon® E Processors 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64 Processor (R/W) Thread 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
MTRR Capability (R/O, Architectural) Thread 
See Table 2-2 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Core 
See Table 2-2. 
0 Thermal Status (R/O) 
See Table 2-2. 
1 Thermal Status Log (R/WCO) 
See Table 2-2. 
2 PROTCHOT # or FORCEPR# Status (R/O) 
See Table 2-2. 


1. MSRs at the following addresses are not supported in the 12th generation Intel Core processor E-core: 3F7H. MSRs at the following 
addresses are not supported in the 12th generation Intel Core processor E-core or P-core: 652H, 653H, 655H, 656H, DBOH, DB1H, 
DB2H, and DSOH. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
3 PROTCHOT # or FORCEPR# Log (R/WCO) 
See Table 2-2. 
4 Critical Temperature Status (R/O) 
See Table 2-2. 
5 Critical Temperature Status Log (R/WCO) 
See Table 2-2. 
6 Thermal threshold #1 Status (R/O) 
See Table 2-2. 
7 Thermal threshold #1 Log (R/WCO) 
See Table 2-2. 
8 Thermal Threshold #2 Status (R/O) 
See Table 2-2. 
9 Thermal Threshold #2 Log (R/WCO) 
See Table 2-2. 
10 Power Limitation Status (R/O) 
See Table 2-2. 
11 Power Limitation Log (R/WCO) 
See Table 2-2. 
12 Current Limit Status (R/O) 
See Table 2-2. 
13 Current Limit Log (R/WCO) 
See Table 2-2. 
14 Cross Domain Limit Status (R/O) 
See Table 2-2. 
15 Cross Domain Limit Log (R/WCO) 
See Table 2-2. 
22:16 Digital Readout (R/O) 
See Table 2-2. 
26:23 Reserved. 
30:27 Resolution in Degrees Celsius (R/O) 
See Table 2-2. 
31 Reading Valid (R/O) 
See Table 2-2. 
63:32 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
Maximum Ratio Limit of Turbo Mode Package 


R/O if MSR_PLATFORM_INFO,[28] = 0, and R/W if MSR_PLATFORM_INFO.[28] = 1 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
7:0 Maximum Ratio Limit for 1C Package 
Maximum turbo ratio limit of 1 core active. 

15:8 Maximum Ratio Limit for 2C Package 
Maximum turbo ratio limit of 2 core active. 
23:16 Maximum Ratio Limit for 3C Package 
Maximum turbo ratio limit of 3 core active. 
31:24 Maximum Ratio Limit for 4C Package 
Maximum turbo ratio limit of 4 core active. 
63:32 Reserved. 
Register Address: 1CSH, 457 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/W) Thread 
Contains an index (bits 0-4) that points to the MSR containing the most recent branch record. 
Register Address: 1FCH, 508 MSR_POWER_CTL 
Power Control Register Core 
See http://biosbits.org. 
0 Reserved. 
1 C1E Enable (R/W) Package 
When set to ‘1’, will enable the CPU to switch to the Minimum Enhanced 
Intel SpeedStep Technology operating point when all execution cores enter 
MWAIT (C1). 
18:2 Reserved. 
19 Disable Energy Efficiency Optimization (R/w) 
Setting this bit disables the P-States energy efficiency optimization. 
Default value is 0. Disable/enable the energy efficiency optimization in P- 
State legacy mode (when IA32_PM_ENABLE[HWP_ENABLE] = 0), has an 
effect only in the turbo range or into PERF_MIN_CTL value if it is not zero 
set. In HWP mode (IA32_PM_ENABLE[HWP_ENABLE] == 1), has an effect 
between the OS desired or OS maximize to the OS minimize performance 
setting. 
20 Disable Race to Halt Optimization (R/W) 
Setting this bit disables the Race to Halt optimization and avoids this 
optimization limitation to execute below the most efficient frequency ratio. 
Default value is O for processors that support Race to Halt optimization. 
63:21 Reserved. 
Register Address: 300H, 768 MSR_SGXOWNEREPOCHO 
Lower 64 Bit CR_SGXOWNEREPOCH (W) Package 


Writes do not update CR_SGXOWNEREPOCH if CPUID.(EAX=1 2H, ECX=0):EAX.SGX1 is 1 on any thread in the package. 


63:0 


Lower 64 bits of an 128-bit external entropy value for key derivation of an 
enclave. 


Register Address: 301H, 769 


MSR_SGXOWNEREPOCH1 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Upper 64 Bit CR_SGXOWNEREPOCH (Ww) Package 
Writes do not update CR_SGXOWNEREPOCH if CPUID.(EAX=1 2H, ECX=0):EAX.SGX1 is 1 on any thread in the package. 
63:0 Upper 64 bits of an 128-bit external entropy value for key derivation of an 

enclave. 

Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” 
0 Ovf_PMCO Thread 
1 Ovf_PMC1 Thread 
2 Ovf_PMC2 Thread 
3 Ovf_PMC3 Thread 
4 Ovt_PMC4 (if CPUID.OAH:EAX[1 5:8] > 4) Thread 
5 Ovf_PMCS5 (if CPUID.OAH:EAX[1 5:8] > 5) Thread 
6 Ovf_PMC6 (if CPUID.OAH:EAX[1 5:8] > 6) Thread 
7 Ovf_PMC7 (if CPUID.OAH:EAX[1 5:8] > 7) Thread 
31:8 Reserved. 
32 Ovf_FixedCtro Thread 
33 Ovf_FixedCtr1 Thread 
34 Ovf_FixedCtr2 Thread 
54:35 Reserved 
55 Trace_ToPA_PMI Thread 
57:56 Reserved. 
58 LBR_Frz Thread 
59 CTR_Frz Thread 
60 ASCl Thread 
61 Ovf_Uncore Thread 
62 Ovf_BufDSSAVE Thread 
63 CondChgd Thread 
Register Address: 390H, 912 IA32_PERF_GLOBAL_STATUS_RESET 
See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” 
0 Set 1 to clear Ovf_PMCO. Thread 
1 Set 1 to clear Ovf_PMC1. Thread 
2 Set 1 to clear Ovf_PMC2. Thread 
3 Set 1 to clear Ovf_PMC3. Thread 
4 Set 1 to clear Ovf_PMC4 (if CPUID.OAH:EAX[1 5:8] > 4). Thread 
5 Set 1 to clear Ovf_PMC5 (if CPUID.OAH:EAX[1 5:8] > 5). Thread 
6 Set 1 to clear Ovf_PMC6 (if CPUID.OAH:EAX[1 5:8] > 6). Thread 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
7 Set 1 to clear Ovf_PMC7 (if CPUID.OAH:EAX[15:8] > 7). Thread 
31:8 Reserved. 
32 Set 1 to clear Ovf_FixedCtr0. Thread 
33 Set 1 to clear Ovf_FixedCtr1. Thread 
34 Set 1 to clear Ovf_FixedCtr2. Thread 
54:35 Reserved. 
55 Set 1 to clear Trace_ToPA_PMI. Thread 
57:56 Reserved. 
58 Set 1 to clear LBR_Frz. Thread 
59 Set 1 to clear CTR_Frz. Thread 
60 Set 1 to clear ASCI. Thread 
61 Set 1 to clear Ovf_Uncore. Thread 
62 Set 1 to clear Ovf_BufDSSAVE. Thread 
63 Set 1 to clear CondChad. Thread 
Register Address: 391H, 913 IA32_PERF_GLOBAL_STATUS_SET 
See Table 2-2 and Section 20.2.4, “Architectural Performance Monitoring Version 4.” 
0 Set 1 to cause Ovf_PMCO = 1. Thread 
1 Set 1 to cause Ovf_PMC1 = 1. Thread 
2 Set 1 to cause Ovf_PMC2 = 1. Thread 
3 Set 1 to cause Ovf_PMC3 = 1. Thread 
4 Set 1 to cause Ovf_PMC4=1 (if CPUID.OAH:EAX[15:8] > 4). Thread 
5 Set 1 to cause Ovf_PMC5=1 (if CPUID.OAH:EAX[15:8] > 5). Thread 
6 Set 1 to cause Ovf_PMC6=1 (if CPUID.OAH:EAX[15:8] > 6). Thread 
7 Set 1 to cause Ovf_PMC7=1 (if CPUID.OAH:EAX[15:8] > 7). Thread 
31:8 Reserved. 
32 Set 1 to cause Ovf_FixedCtrO = 1. Thread 
33 Set 1 to cause Ovf_FixedCtr1 = 1. Thread 
34 Set 1 to cause Ovf_FixedCtr2 = 1. Thread 
54:35 Reserved. 
55 Set 1 to cause Trace_ToPA_PMI = 1. Thread 
57:56 Reserved. 
58 Set 1 to cause LBR_Frz = 1. Thread 
59 Set 1 to cause CTR_Frz = 1. Thread 
60 Set 1 to cause ASCI = 1. Thread 
61 Set 1 to cause Ovf_Uncore. Thread 
62 Set 1 to cause Ovf_BufDSSAVE. Thread 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
63 Reserved. 
Register Address: 392H, 914 IA32_PERF_GLOBAL_INUSE 
See Table 2-2. Thread 
Register Address: 3F7H, 1015 MSR_PEBS_FRONTEND 
FrontEnd Precise Event Condition Select (R/W) Thread 
2:0 Event Code Select 
3 Reserved 
4 Event Code Select High 
75 Reserved. 
19:8 IDQ_Bubble_Length Specifier 
22:20 IDQ_Bubble_Width Specifier 
63:23 Reserved. 
Register Address: 500H, 1280 IA32_SGX_SVN_STATUS 
Status and SVN Threshold of SGX Support for ACM (R/O) Thread 
0 Lock 
See Section 39.11.3, “Interactions with Authenticated Code Modules 
(ACMs).” 
15:1 Reserved. 
23:16 SGX_SVN_SINIT 
See Section 39.11.3, “Interactions with Authenticated Code Modules 
(ACMs).” 
63:24 Reserved. 
Register Address: 560H, 1376 IA32_RTIT_OUTPUT_BASE 
Trace Output Base Register (R/W) Thread 
See Table 2-2. 
Register Address: 561H, 1377 IA32_RTIT_OUTPUT_MASK_PTRS 
Trace Output Mask Pointers Register (R/W) Thread 
See Table 2-2. 
Register Address: 570H, 1392 IA32_RTIT_CTL 
Trace Control Register (R/W) Thread 
0 TraceEn 
1 CYCEn 
2 Os 
e| User 
6:4 Reserved, must be zero. 
7 CR3Filter 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
8 ToPA 

Writing O will #GP if also setting TraceEn. 

9 MTCEn 
10 TSCEn 
11 DisRETC 
12 Reserved, must be zero. 
13 BranchEn 
17:14 MTCFreq 
18 Reserved, must be zero. 
22:19 CycThresh 
23 Reserved, must be zero. 
27:24 PSBFreq 
31:28 Reserved, must be zero. 
35:32 ADDRO_CFG 
39:36 ADDR1_CFG 
63:40 Reserved, must be zero. 
Register Address: 571H, 1393 IA32_RTIT_STATUS 
Tracing Status Register (R/W) Thread 
0 FilterEn, writes ignored. 
1 Contex€En, writes ignored. 
2 TriggerEn, writes ignored. 
3 Reserved 
4 Error (R/W) 
5 Stopped 
31:6 Reserved, must be zero. 
48:32 PacketByteCnt 
63:49 Reserved, must be zero. 
Register Address: 572H, 1394 IA32_RTIT_CR3_MATCH 
Trace Filter CR3 Match Register (R/W) Thread 
4:0 Reserved 
63:5 CR3[63:5] value to match 
Register Address: 580H, 1408 IA32_RTIT_ADDRO_A 
Region O Start Address (R/W) Thread 
63:0 See Table 2-2. 
Register Address: 581H, 1409 IA32_RTIT_ADDRO_B 
Region O End Address (R/W) Thread 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
63:0 See Table 2-2. 
Register Address: 582H, 1410 IA32_RTIT_ADDR1_A 
Region 1 Start Address (R/W) Thread 
63:0 See Table 2-2. 
Register Address: 583H, 1411 IA32_RTIT_ADDR1_B 
Region 1 End Address (R/W) Thread 
63:0 See Table 2-2. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 
Register Address: 64DH, 1613 MSR_PLATFORM_ENERGY_COUNTER 
Platform Energy Counter (R/O) Platform 
This MSR is valid only if both platform vendor hardware implementation and BIOS enablement support it. This MSR 
will read 0 if not valid. 
31:0 Total energy consumed by all devices in the platform that receive power 
from integrated power delivery mechanism, included platform devices are 
processor cores, SOC, memory, add-on or peripheral devices that get 
powered directly from the platform power delivery means. The energy 
units are specified in the MSR_RAPL_POWER_UNIT.Enery_Status_Unit. 
63:32 Reserved. 
Register Address: 64E€H, 1614 MSR_PPERF 
Productive Performance Count (R/O) Thread 
63:0 Hardware’s view of workload scalability. See Section 15.4.5.1. 
Register Address: 64FH, 1615 MSR_CORE_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in Processor Cores (R/W) Package 
(Frequency refers to processor core frequency.) 
0 PROCHOT Status (RO) 
When set, frequency is reduced below the operating system request due 
to assertion of external PROCHOT. 
1 Thermal Status (RO) 
When set, frequency is reduced below the operating system request due 
to a thermal event. 
3:2 Reserved. 
4 Residency State Regulation Status (RO) 
When set, frequency is reduced below the operating system request due 
to residency state regulation limit. 
5 Running Average Thermal Limit Status (RO) 
When set, frequency is reduced below the operating system request due 
to Running Average Thermal Limit (RATL). 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 

6 VR Therm Alert Status (RO) 
When set, frequency is reduced below the operating system request due 
to a thermal alert from a processor Voltage Regulator (VR). 

7 VR Therm Design Current Status (RO) 
When set, frequency is reduced below the operating system request due 
to VR thermal design current limit. 

8 Other Status (RO) 
When set, frequency is reduced below the operating system request due 
to electrical or other constraints. 

9 Reserved. 

10 Package/Platform-Level Power Limiting PL1 Status (RO) 
When set, frequency is reduced below the operating system request due 
to package/platform-level power limiting PL1. 

11 Package/Platform-Level PL2 Power Limiting Status (RO) 
When set, frequency is reduced below the operating system request due 
to package/platform-level power limiting PL2/PL3. 

12 Max Turbo Limit Status (RO) 
When set, frequency is reduced below the operating system request due 
to multi-core turbo limits. 

13 Turbo Transition Attenuation Status (RO) 
When set, frequency is reduced below the operating system request due 
to Turbo transition attenuation. This prevents performance degradation 
due to frequent operating ratio changes. 

15:14 Reserved. 

16 PROCHOT Log 
When set, indicates that the PROCHOT Status bit has asserted since the 
log bit was last cleared. 
This log bit will remain set until cleared by software writing 0. 

17 Thermal Log 
When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

19:18 Reserved. 

20 Residency State Regulation Log 
When set, indicates that the Residency State Regulation Status bit has 
asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

21 Running Average Thermal Limit Log 
When set, indicates that the RATL Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing 0. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


22 


VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


23 


VR Thermal Design Current Log 


When set, indicates that the VR TDC Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


24 


25 


Other Log 


When set, indicates that the Other Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing O. 


Reserved. 


26 


Package/Platform-Level PL1 Power Limiting Log 


When set, indicates that the Package or Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


27 


28 


Package/Platform-Level PL2 Power Limiting Log 


When set, indicates that the Package or Platform Level PL2/PL3 Power 
Limiting Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


Max Turbo Limit Log 


When set, indicates that the Max Turbo Limit Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


29 


Turbo Transition Attenuation Log 


When set, indicates that the Turbo Transition Attenuation Status bit has 
asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


63:30 
Register Address: 652H, 1618 


Reserved. 
MSR_PKG_HDC_CONFIG 


HDC Configuration (R/W) 


Package 


2:0 


PKG_Cx_Monitor 


Configures Package Cx state threshold for 
MSR_PKG_HDC_DEEP_RESIDENCY. 


63:3 


Reserved. 


Register Address: 653H, 1619 


MSR_CORE_HDC_RESIDENCY 


Core HDC Idle Residency (R/O) 
63:0 


Core_Cx_Duty_Cycle_Cnt 


Core 


Register Address: 655H, 1621 


MSR_PKG_HDC_SHALLOW_RESIDENCY 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Accumulate the cycles the package was in C2 state and at least one logical processor was in forced idle (R/O) Package 
63:0 Pkg_C2_Duty_Cycle_Cnt 
Register Address: 656H, 1622 MSR_PKG_HDC_DEEP_RESIDENCY 
Package Cx HDC Idle Residency (R/O) Package 
63:0 Pkg_Cx_Duty_Cycle_Cnt 
Register Address: 658H, 1624 MSR_WEIGHTED_CORE_CO 
Core-count Weighted CO Residency (R/O) Package 
63:0 Increment at the same rate as the TSC. The increment each cycle is 


weighted by the number of processor cores in the package that reside in 
CO. If N cores are simultaneously in CO, then each cycle the counter 
increments by N. 


Register Address: 659H, 1625 MSR_ANY_CORE_CO 
Any Core CO Residency (R/O) Package 
63:0 Increment at the same rate as the TSC. The increment each cycle is one if 

any processor core in the package is in CO. 
Register Address: 65AH, 1626 MSR_ANY_GFXE_CO 
Any Graphics Engine CO Residency (R/O) Package 
63:0 Increment at the same rate as the TSC. The increment each cycle is one if 

any processor graphic device's compute engines are in CO. 
Register Address: 65BH, 1627 MSR_CORE_GFXE_OVERLAP_CO 
Core and Graphics Engine Overlapped CO Residency (R/O) Package 
63:0 Increment at the same rate as the TSC. The increment each cycle is one if 


at least one compute engine of the processor graphics is in CO and at least 
one processor core in the package is also in CO. 


Register Address: 65CH, 1628 MSR_PLATFORM_POWER_LIMIT 


Platform Power Limit Control (R/W-L) Platform 


Allows platform BIOS to limit power consumption of the platform devices to the specified values. The Long Duration 
power consumption is specified via Platform_Power_Limit_1 and Platform_Power_Limit_1_Time. The Short Duration 
power consumption limit is specified via the Platform_Power_Limit_2 with duration chosen by the processor. 


The processor implements an exponential-weighted algorithm in the placement of the time windows. 


14:0 Platform Power Limit #1 

Average Power limit value which the platform must not exceed over a time 
window as specified by Power_Limit_1_TIME field. 

The default value is the Thermal Design Power (TDP) and varies with 
product skus. The unit is specified in MSR_RAPLPOWER_UNIT. 


15 Enable Platform Power Limit #1 


When set, enables the processor to apply control policy such that the 
platform power does not exceed Platform Power limit #1 over the time 
window specified by Power Limit #1 Time Window. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


16 


Platform Clamping Limitation #1 


When set, allows the processor to go below the OS requested P states in 
order to maintain the power below specified Platform Power Limit #1 
value. 


This bit is writeable only when CPUID (EAX=6):EAX[4] is set. 


23:17 


Time Window for Platform Power Limit #1 


Specifies the duration of the time window over which Platform Power 
Limit 1 value should be maintained for sustained long duration. This field is 
made up of two numbers from the following equation: 


Time Window = (float) ((1+(X/4))*(2“Y)), where: 
X = POWER_LIMIT_1_TIME[23:22] 
Y = POWER_LIMIT_1_TIME[21:17] 


The maximum allowed value in this field is defined in 
MSR_PKG_POWER_INFO[PKG_MAX_WIN]. 


The default value is ODH, and the unit is specified in 
MSR_RAPL_POWER_UNIT[Time Unit]. 


31:24 


Reserved. 


46:32 


Platform Power Limit #2 


Average Power limit value which the platform must not exceed over the 
Short Duration time window chosen by the processor. 

The recommended default value is 1.25 times the Long Duration Power 
Limit (i.e., Platform Power Limit # 1). 


47 


Enable Platform Power Limit #2 


When set, enables the processor to apply control policy such that the 
platform power does not exceed Platform Power limit #2 over the Short 
Duration time window. 


48 


Platform Clamping Limitation #2 


When set, allows the processor to go below the OS requested P states in 
order to maintain the power below specified Platform Power Limit #2 
value. 


62:49 


Reserved. 


63 


Lock. Setting this bit will lock all other bits of this MSR until system RESET. 


Register Address: 690H, 1680 


MSR_LASTBRANCH_16_FROM_IP 


Last Branch Record 16 From IP (R/W) 


* Last Branch Record Stack TOS at 1C9H. 
* Section 18.12. 


One of 32 triplets of last branch record registers on the last branch record stack. This part of the stack contains 
pointers to the source instruction. See also: 


Thread 


Register Address: 691H, 1681 


MSR_LASTBRANCH_17_FROM_IP 


Last Branch Record 17 From IP (R/W) 


See description of MSR_LASTBRANCH_O_FROM_IP. 


Thread 


Register Address: 692H, 1682 


MSR_LASTBRANCH_18_FROM_IP 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 

Last Branch Record 18 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 693H, 1683 MSR_LASTBRANCH_19_FROM_IP 

Last Branch Record 19From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 694H, 1684 MSR_LASTBRANCH_20_FROM_IP 

Last Branch Record 20 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 695H, 1685 MSR_LASTBRANCH_21_FROM_IP 

Last Branch Record 21 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 696H, 1686 MSR_LASTBRANCH_22_FROM_IP 

Last Branch Record 22 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 697H, 1687 MSR_LASTBRANCH_23_FROM_IP 

Last Branch Record 23 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 698H, 1688 MSR_LASTBRANCH_24_FROM_IP 

Last Branch Record 24 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 699H, 1689 MSR_LASTBRANCH_25_FROM_IP 

Last Branch Record 25 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69AH, 1690 MSR_LASTBRANCH_26_FROM_IP 

Last Branch Record 26 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69BH, 1691 MSR_LASTBRANCH_27_FROM_IP 

Last Branch Record 27 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69CH, 1692 MSR_LASTBRANCH_28_FROM_IP 

Last Branch Record 28 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69DH, 1693 MSR_LASTBRANCH_29_FROM_IP 

Last Branch Record 29 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 

Register Address: 69EH, 1694 MSR_LASTBRANCH_30_FROM_IP 

Last Branch Record 30 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 69FH, 1695 MSR_LASTBRANCH_31_FROM_IP 
Last Branch Record 31 From IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_FROM_IP. 
Register Address: 6BOH, 1712 MSR_GRAPHICS_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in the Processor Graphics (R/W) Package 
(Frequency refers to processor graphics frequency.) 
0 PROCHOT Status (RO) 
When set, frequency is reduced due to assertion of external PROCHOT. 
1 Thermal Status (RO) 
When set, frequency is reduced due to a thermal event. 
4:2 Reserved. 
Running Average Thermal Limit Status (RO) 
When set, frequency is reduced due to running average thermal limit. 
6 VR Therm Alert Status (RO) 
When set, frequency is reduced due to a thermal alert from a processor 
Voltage Regulator. 
7 VR Thermal Design Current Status (RO) 
When set, frequency is reduced due to VR TDC limit. 
8 Other Status (RO) 
When set, frequency is reduced due to electrical or other constraints. 
9 Reserved. 
10 Package/Platform-Level Power Limiting PL1 Status (RO) 
When set, frequency is reduced due to package/platform-level power 
limiting PL1. 
11 Package/Platform-Level PL2 Power Limiting Status (RO) 
When set, frequency is reduced due to package/platform-level power 
limiting PL2/PL3. 
12 Inefficient Operation Status (RO) 
When set, processor graphics frequency is operating below target 
frequency. 
15:13 Reserved. 
16 PROCHOT Log 
When set, indicates that the PROCHOT Status bit has asserted since the 
log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 
17 Thermal Log 
When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 
This log bit will remain set until cleared by software writing O. 
20:18 Reserved. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


21 


Running Average Thermal Limit Log 


When set, indicates that the RATL Status bit has asserted since the log bit 
was last cleared. 


This log bit will remain set until cleared by software writing 0. 


22 


VR Therm Alert Log 


When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing O. 


23 


24 


VR Thermal Design Current Log 


When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


Other Log 


When set, indicates that the OTHER Status bit has asserted since the log 
bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


25 


Reserved. 


26 


27 


Package/Platform-Level PL1 Power Limiting Log 


When set, indicates that the Package/Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


Package/Platform-Level PL2 Power Limiting Log 


When set, indicates that the Package/Platform Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


28 


Inefficient Operation Log 


When set, indicates that the Inefficient Operation Status bit has asserted 
since the log bit was last cleared. 


This log bit will remain set until cleared by software writing 0. 


63:29 
Register Address: 6B1H, 1713 


Reserved. 
MSR_RING_PERF_LIMIT_REASONS 


Indicator of Frequency Clipping in the Ring Interconnect (R/W) 
(Frequency refers to ring interconnect in the uncore.) 


Package 


0) 


PROCHOT Status (RO) 
When set, frequency is reduced due to assertion of external PROCHOT. 


Thermal Status (RO) 
When set, frequency is reduced due to a thermal event. 


Reserved. 


Running Average Thermal Limit Status (RO) 
When set, frequency is reduced due to running average thermal limit. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


6 VR Therm Alert Status (RO) 
When set, frequency is reduced due to a thermal alert from a processor 
Voltage Regulator. 

7 VR Thermal Design Current Status (RO) 
When set, frequency is reduced due to VR TDC limit. 

8 Other Status (RO) 
When set, frequency is reduced due to electrical or other constraints. 

9 Reserved. 

10 Package/Platform-Level Power Limiting PL1 Status (RO) 
When set, frequency is reduced due to package/Platform-level power 
limiting PL1. 

11 Package/Platform-Level PL2 Power Limiting Status (RO) 
When set, frequency is reduced due to package/Platform-level power 
limiting PL2/PL3. 

15:12 Reserved 

16 PROCHOT Log 
When set, indicates that the PROCHOT Status bit has asserted since the 
log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

17 Thermal Log 
When set, indicates that the Thermal Status bit has asserted since the log 
bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

20:18 Reserved. 

21 Running Average Thermal Limit Log 
When set, indicates that the RATL Status bit has asserted since the log bit 
was last cleared. 
This log bit will remain set until cleared by software writing O. 

22 VR Therm Alert Log 
When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

23 VR Thermal Design Current Log 
When set, indicates that the VR Therm Alert Status bit has asserted since 
the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

24 Other Log 
When set, indicates that the OTHER Status bit has asserted since the log 
bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

25 Reserved. 
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One of 32 triplets of last branch record registers on the last branch record stack. This part of the stack contains 
pointers to the destination instruction. See also: 


* Last Branch Record Stack TOS at 1CSH. 
= Section 18.12. 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
26 Package/Platform-Level PL1 Power Limiting Log 
When set, indicates that the Package/Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 
27 Package/Platform-Level PL2 Power Limiting Log 
When set, indicates that the Package/Platform Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 
63:28 Reserved. 
Register Address: 6DOH, 1744 MSR_LASTBRANCH_16_TO_IP 
Last Branch Record 16 To IP (R/W) Thread 


Register Address: 6D1H, 1745 MSR_LASTBRANCH_17_TO_IP 


See description of MSR_LASTBRANCH_O_TO_IP. 


Last Branch Record 17 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_0_TO_IP. 

Register Address: 6D2H, 1746 MSR_LASTBRANCH_18_TO_IP 

Last Branch Record 18 To IP (R/W) Thread 


Last Branch Record 19To IP (R/W) 
See description of MSR_LASTBRANCH_O_TO_IP. 


Register Address: 6D3H, 1747 MSR_LASTBRANCH_19_TO_IP 
Register Address: 6D4H, 1748 MSR_LASTBRANCH_20_TO_IP 


Thread 


See description of MSR_LASTBRANCH_0O_TO_IP. 


Last Branch Record 20 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 

Register Address: 6D5H, 1749 MSR_LASTBRANCH_21_TO_IP 

Last Branch Record 21 To IP (R/W) Thread 


Register Address: 6D6H, 1750 MSR_LASTBRANCH_22_TO_IP 


See description of MSR_LASTBRANCH_O_TO_IP. 


Last Branch Record 22 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_0O_TO_IP. 

Register Address: 6D7H, 1751 MSR_LASTBRANCH_23_TO_IP 

Last Branch Record 23 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_0O_TO_IP. 

Register Address: 6D8H, 1752 MSR_LASTBRANCH_24_TO_IP 

Last Branch Record 24 To IP (R/W) Thread 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 6D9H, 1753 MSR_LASTBRANCH_25_TO_IP 
Last Branch Record 25 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DAH, 1754 MSR_LASTBRANCH_26_TO_IP 
Last Branch Record 26 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DBH, 1755 MSR_LASTBRANCH_27_TO_IP 
Last Branch Record 27 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DCH, 1756 MSR_LASTBRANCH_28_TO_IP 
Last Branch Record 28 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DDH, 1757 MSR_LASTBRANCH_29_TO_IP 
Last Branch Record 29 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DEH, 1758 MSR_LASTBRANCH_30_TO_IP 
Last Branch Record 30 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 6DFH, 1759 MSR_LASTBRANCH_31_TO_IP 
Last Branch Record 31 To IP (R/W) Thread 
See description of MSR_LASTBRANCH_O_TO_IP. 
Register Address: 770H, 1904 IA32_PM_ENABLE 
See Section 15.4.2, “Enabling HWP.” Package 
Register Address: 771H, 1905 IA32_HWP_CAPABILITIES 
See Section 15.4.3, “HWP Performance Range and Dynamic Capabilities.” Thread 
Register Address: 772H, 1906 IA32_HWP_REQUEST_PKG 
See Section 15.4.4, “Managing HWP.” Package 
Register Address: 773H, 1907 IA32_HWP_INTERRUPT 
See Section 15.4.6, “HWP Notifications.” Thread 
Register Address: 774H, 1908 IA32_HWP_REQUEST 
See Section 15.4.4, “Managing HWP.” Thread 
7:0 Minimum Performance (R/W) 
15:8 Maximum Performance (R/W) 
23:16 Desired Performance (R/W) 
31:24 Energy/Performance Preference (R/W) 
41:32 Activity Window (R/W) 
42 Package Control (R/W) 
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63:43 Reserved. 
Register Address: 777H, 1911 IA32_HWP_STATUS 
See Section 15.4.5, “HWP Feedback.” Thread 
Register Address: DSOH, 3472 IA32_BNDCFGS 
See Table 2-2. Thread 
Register Address: DAOH, 3488 IA32_XSS 
See Table 2-2. Thread 
Register Address: DBOH, 3504 IA32_PKG_HDC_CTL 
See Section 15.5.2, “Package level Enabling HDC.” Package 
Register Address: DB1H, 3505 IA32_PM_CTL1 
See Section 15.5.3, “Logical-Processor Level HDC Control.” Thread 
Register Address: DB2H, 3506 IA32_THREAD_STALL 
See Section 15.5.4.1, “IA32_THREAD_STALL.” Thread 
Register Address: DCOH, 3520 MSR_LBR_INFO_O 
Last Branch Record 0 Additional Information (R/w) Thread 
One of 32 triplet of last branch record registers on the last branch record stack. This part of the stack contains flag, 
TSX-related and elapsed cycle information. See also: 
* Last Branch Record Stack TOS at 1C9SH. 
* Section 18.9.1, “LBR Stack.” 
Register Address: DC1H, 3521 MSR_LBR_INFO_1 
Last Branch Record 1 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC2H, 3522 MSR_LBR_INFO_2 
Last Branch Record 2 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC3H, 3523 MSR_LBR_INFO_3 
Last Branch Record 3 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC4H, 3524 MSR_LBR_INFO_4 
Last Branch Record 4 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC5H, 3525 MSR_LBR_INFO_5 
Last Branch Record 5 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC6H, 3526 MSR_LBR_INFO_6 
Last Branch Record 6 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC7H, 3527 MSR_LBR_INFO_7 
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Last Branch Record 7 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DC8H, 3528 MSR_LBR_INFO_8 
Last Branch Record 8 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCSH, 3529 MSR_LBR_INFO_9 
Last Branch Record 9 Additional Information (R/w) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCAH, 3530 MSR_LBR_INFO_10 
Last Branch Record 10 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCBH, 3531 MSR_LBR_INFO_11 
Last Branch Record 11 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCCH, 3532 MSR_LBR_INFO_12 
Last Branch Record 12 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCDH, 3533 MSR_LBR_INFO_13 
Last Branch Record 13 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCEH, 3534 MSR_LBR_INFO_14 
Last Branch Record 14 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DCFH, 3535 MSR_LBR_INFO_15 
Last Branch Record 15 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DDOH, 3536 MSR_LBR_INFO_16 
Last Branch Record 16 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DD1H, 3537 MSR_LBR_INFO_17 
Last Branch Record 17 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DD2H, 3538 MSR_LBR_INFO_18 
Last Branch Record 18 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
Register Address: DD3H, 3539 MSR_LBR_INFO_19 
Last Branch Record 19 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 

Register Address: DD4H, 3540 MSR_LBR_INFO_20 

Last Branch Record 20 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DD5H, 3541 MSR_LBR_INFO_21 

Last Branch Record 21 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DD6H, 3542 MSR_LBR_INFO_22 

Last Branch Record 22 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DD7H, 3543 MSR_LBR_INFO_23 

Last Branch Record 23 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DD8H, 3544 MSR_LBR_INFO_24 

Last Branch Record 24 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDSH, 3545 MSR_LBR_INFO_25 

Last Branch Record 25 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDAH, 3546 MSR_LBR_INFO_26 

Last Branch Record 26 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDBH, 3547 MSR_LBR_INFO_27 

Last Branch Record 27 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDCH, 3548 MSR_LBR_INFO_28 

Last Branch Record 28 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDDH, 3549 MSR_LBR_INFO_29 

Last Branch Record 29 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDEH, 3550 MSR_LBR_INFO_30 

Last Branch Record 30 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 

Register Address: DDFH, 3551 MSR_LBR_INFO_31 

Last Branch Record 31 Additional Information (R/W) Thread 
See description of MSR_LBR_INFO_O. 
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Table 2-40. Uncore PMU MSRs Supported by 6th Generation, 7th Generation, and 8th Generation Intel® Core™ 
Processors, and 8th generation Intel® Core™ i3 Processors 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 394H, 916 MSR_UNC_PERF_FIXED_CTRL 
Uncore Fixed Counter Control (R/W) Package 
19:0 Reserved. 
20 Enable overflow propagation. 
21 Reserved. 
22 Enable counting. 
63:23 Reserved. 
Register Address: 395H, 917 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
43:0 Current count. 
63:44 Reserved. 
Register Address: 396H, 918 MSR_UNC_CBO_CONFIG 
Uncore C-Box Configuration Information (R/O) Package 
3:0 Specifies the number of C-Box units with programmable counters 

(including processor cores and processor graphics). 

63:4 Reserved. 
Register Address: 3BOH, 946 MSR_UNC_ARB_PERFCTRO 
Uncore Arb Unit, Performance Counter 0 Package 
Register Address: 3B1H, 947 MSR_UNC_ARB_PERFCTR1 
Uncore Arb Unit, Performance Counter 1 Package 
Register Address: 3B2H, 944 MSR_UNC_ARB_PERFEVTSELO 
Uncore Arb Unit, Counter O Event Select MSR Package 
Register Address: 3B3H, 945 MSR_UNC_ARB_PERFEVTSEL1 
Uncore Arb Unit, Counter 1 Event Select MSR Package 
Register Address: 700H, 1792 MSR_UNC_CBO_0_PERFEVTSELO 
Uncore C-Box 0, Counter O Event Select MSR Package 
Register Address: 701H, 1793 MSR_UNC_CBO_0_PERFEVTSEL1 
Uncore C-Box 0, Counter 1 Event Select MSR Package 
Register Address: 706H, 1798 MSR_UNC_CBO_0_PERFCTRO 
Uncore C-Box 0, Performance Counter 0 Package 
Register Address: 707H, 1799 MSR_UNC_CBO_0_PERFCTR1 
Uncore C-Box 0, Performance Counter 1 Package 
Register Address: 710H, 1808 MSR_UNC_CBO_1_PERFEVTSELO 
Uncore C-Box 1, Counter O Event Select MSR Package 
Register Address: 711H, 1809 MSR_UNC_CBO_1_PERFEVTSEL1 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 1, Counter 1 Event Select MSR Package 
Register Address: 716H, 1814 MSR_UNC_CBO_1_PERFCTRO 
Uncore C-Box 1, Performance Counter O Package 
Register Address: 717H, 1815 MSR_UNC_CBO_1_PERFCTR1 
Uncore C-Box 1, Performance Counter 1 Package 
Register Address: 720H, 1824 MSR_UNC_CBO_2_PERFEVTSELO 
Uncore C-Box 2, Counter O Event Select MSR Package 
Register Address: 721H, 1825 MSR_UNC_CBO_2_PERFEVTSEL1 
Uncore C-Box 2, Counter 1 Event Select MSR Package 
Register Address: 726H, 1830 MSR_UNC_CBO_2_PERFCTRO 
Uncore C-Box 2, Performance Counter 0 Package 
Register Address: 727H, 1831 MSR_UNC_CBO_2_PERFCTR1 
Uncore C-Box 2, Performance Counter 1 Package 
Register Address: 730H, 1840 MSR_UNC_CBO_3_PERFEVTSELO 
Uncore C-Box 3, Counter O Event Select MSR Package 
Register Address: 731H, 1841 MSR_UNC_CBO_3_PERFEVTSEL1 
Uncore C-Box 3, Counter 1 Event Select MSR Package 
Register Address: 736H, 1846 MSR_UNC_CBO_3_PERFCTRO 
Uncore C-Box 3, Performance Counter 0 Package 
Register Address: 737H, 1847 MSR_UNC_CBO_3_PERFCTR1 
Uncore C-Box 3, Performance Counter 1 Package 
Register Address: E€01H, 3585 MSR_UNC_PERF_GLOBAL_CTRL 
Uncore PMU Global Control Package 
0 Slice O select. 
1 Slice 1 select. 
2 Slice 2 select. 
3 Slice 3 select. 
4 Slice 4select. 
18:5 Reserved. 
29 Enable all uncore counters. 
30 Enable wake on PMI. 
31 Enable Freezing counter when overflow. 
63:32 Reserved. 
Register Address: 02H, 3586 MSR_UNC_PERF_GLOBAL_STATUS 
Uncore PMU Main Status Package 
0 Fixed counter overflowed. 
1 An ARB counter overflowed. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


Reserved. 


A CBox counter overflowed (on any slice). 


63:4 


Reserved. 


2.17.1 MSRs Introduced in 7th Generation and 8th Generation Intel® Core™ Processors Based 
on Kaby Lake Microarchitecture and Coffee Lake Microarchitecture 
Table 2-41 lists additional MSRs for 7th generation and 8th generation Intel Core processors with a CPUID Signa- 


ture DisplayFamily_DisplayModel value of 06_8EH or 06_9EH. For an MSR listed in Table 2-41 that also appears in 
the model-specific tables of prior generations, Table 2-41 supersedes prior generation tables. 


Table 2-41. Additional MSRs Supported by the 7th Generation and 8th Generation Intel® Core™ Processors Based 
on Kaby Lake Microarchitecture and Coffee Lake Microarchitecture 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 80H, 128 MSR_TRACE_HUB_STH_ACPIBAR_BASE 
NPK Address Used by AET Messages (R/W) Package 
0 Lock Bit 
If set, this MSR cannot be re-written anymore. Lock bit has to be set in 
order for the AET packets to be directed to NPK MMIO. 
17:1 Reserved. 
63:18 ACPIBAR_BASE_ADDRESS 
AET target address in NPK MMIO space. 
Register Address: 1F4H, 500 MSR_PRMRR_PHYS_BASE 
Processor Reserved Memory Range Register - Physical Base Control Register (R/W) Core 
2:0 MemType 
PRMRR BASE MemType. 
11:3 Reserved. 
45:12 Base 
PRMRR Base Address. 
63:46 Reserved. 
Register Address: 1F5H, 501 MSR_PRMRR_PHYS_MASK 
Processor Reserved Memory Range Register - Physical Mask Control Register (R/W) Core 
9:0 Reserved. 
10 Lock 
Lock bit for the PRMRR. 
11 VLD 
Enable bit for the PRMRR. 
45:12 Mask 
PRMRR MASK bits. 
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Table 2-41. Additional MSRs Supported by the 7th Generation and 8th Generation Intel® Core™ Processors Based 
on Kaby Lake Microarchitecture and Coffee Lake Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
63:46 Reserved. 
Register Address: 1FBH, 507 MSR_PRMRR_VALID_CONFIG 
Valid PRMRR Configurations (R/W) Core 
0 1M supported MEE size. 
4:1 Reserved. 
5 32M supported MEE size. 
6 64M supported MEE size. 
7 128M supported MEE size. 
31:8 Reserved. 
Register Address: 2F4H, 756 MSR_UNCORE_PRMRR_PHYS_BASE! 
(R/W) Package 
The PRMRR range is used to protect the processor reserved memory from unauthorized reads and writes. Any IO 
access to this range is aborted. This register controls the location of the PRMRR range by indicating its starting 
address. It functions in tandem with the PRMRR mask register. 
11:0 Reserved. 
PAWIDTH-1:12 Range Base 
This field corresponds to bits PAWIDTH-1:1 2 of the base address memory 
range which is allocated to PRMRR memory. 
63:PAWIDTH Reserved. 
Register Address: 2F5H, 757 MSR_UNCORE_PRMRR_PHYS_MASK! 
(R/W) Package 
This register controls the size of the PRMRR range by indicating which address bits must match the PRMRR base 
register value. 
9:0 Reserved. 
10 Lock 
Setting this bit locks all writeable settings in this register, including itself. 
11 Range_En 
Indicates whether the PRMRR range is enabled and valid. 
38:12 Range_Mask 
This field indicates which address bits must match PRMRR base in order 
to qualify as an PRMRR access. 
63:39 Reserved. 
Register Address: 620H, 1568 MSR_RING_RATIO_LIMIT 
Ring Ratio Limit (R/W) Package 


This register provides Min/Max Ratio Limits for the LLC and Ring. 


6:0 MAX_Ratio 
This field is used to limit the max ratio of the LLC/Ring. 
7 Reserved. 
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Table 2-41. Additional MSRs Supported by the 7th Generation and 8th Generation Intel® Core™ Processors Based 
on Kaby Lake Microarchitecture and Coffee Lake Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
14:8 MIN_Ratio 
Writing to this field controls the minimum possible ratio of the LLC/Ring. 
63:15 Reserved. 
NOTES: 


1. This MSR is specific to 7th generation and 8th generation Intel® Core™ processors. 


2.17.2 |MSRs Specific to 8th Generation Intel® Core™ i3 Processors 


Table 2-42 lists additional MSRs for 8th generation Intel Core i3 processors with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_66H. For an MSR listed in Table 2-42 that also appears in the model- 
specific tables of prior generations, Table 2-42 supersede prior generation tables. 


Table 2-42. Additional MSRs Supported by the 8th Generation Intel® Core™ i3 Processors 
Based on Cannon Lake Microarchitecture 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64 Processor (R/W) Thread 
See Table 2-2. 
0 Lock (R/WL) 
1 Enable VMX Inside SMX Operation (R/WL) 
2 Enable VMX Outside SMX Operation (R/WL) 
14:8 SENTER Local Functions Enables (R/WL) 
15 SENTER Global Functions Enable (R/WL) 
17 SGX Launch Control Enable (R/WL) 


This bit must be set to enable runtime reconfiguration of SGX Launch 
Control via |A32_SGXLEPUBKEYHASHh MSR. 


Available only if CPUID.(EAX=07H, ECX=OH): ECX[30] = 1. 


18 SGX Global Functions Enable (R/WL) 
63:21 Reserved. 

Register Address: 350H, 848 MSR_BR_DETECT_CTRL 

Branch Monitoring Global Control (R/W) 

0 EnMonitoring 


Global enable for branch monitoring. 


1 EnExcept 
Enable branch monitoring event signaling on threshold trip. 


The branch monitoring event handler is signaled via the existing PMI 
signaling mechanism as programmed from the corresponding local APIC 
LVT entry. 
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Based on Cannon Lake Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


EnLBRFrz 


Enable LBR freeze on threshold trip. This will cause the LBR frozen bit 
58 to be set in IA32_PERF_GLOBAL_STATUS when a triggering 
condition occurs and this bit is enabled. 


DisablelnGuest 


When set to ‘1’, branch monitoring, event triggering and LBR freeze 
actions are disabled when operating at VMX non-root operation. 


Reserved. 


WindowSize 
Window size defined by WindowCntSel. Values 0 - 1023 are supported. 


Once the Window counter reaches the WindowSize count both the 
Window Counter and all Branch Monitoring Counters are cleared. 


23:18 


Reserved. 


25:24 


WindowCntSel 

Window event count select: 

‘00 = Instructions retired. 

‘O01 = Branch instructions retired 

‘10 = Return instructions retired. 

‘11 = Indirect branch instructions retired. 


26 


CntAndMode 


When set to ‘1’, the overall branch monitoring event triggering 
condition is true only if all enabled counters’ threshold conditions are 
true. 


When ‘0’, the threshold tripping condition is true if any enabled 
counters’ threshold is true. 


63:27 


Reserved. 


Register Address: 351H, 849 


MSR_BR_DETECT_STATUS 


Branch Monitoring Global Status (R/W) 


0 


Branch Monitoring Event Signaled 


When set to ‘1’, Branch Monitoring event signaling is blocked until this 
bit is cleared by software. 


LBRsValid 


This status bit is set to ‘1’ if the LBR state is considered valid for 
sampling by branch monitoring software. 


7:2 Reserved. 

8 CntrHitO 
Branch monitoring counter #0 threshold hit. This status bit is sticky 
and once set requires clearing by software. Counter operation 
continues independent of the state of the bit. 

9 CntrHit1 


Branch monitoring counter #1 threshold hit. This status bit is sticky 
and once set requires clearing by software. Counter operation 
continues independent of the state of the bit. 
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Table 2-42. Additional MSRs Supported by the 8th Generation Intel® Core™ i3 Processors 
Based on Cannon Lake Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
15:10 Reserved. 
Reserved for additional branch monitoring counters threshold hit 
status. 
25:16 CountWindow 


The current value of the window counter. The count value is frozen on 
a valid branch monitoring triggering condition. This is a 10-bit unsigned 


value. 
31:26 Reserved. 

Reserved for future extension of CountWindow. 
39:32 CountO 


The current value of counter O updated after each occurrence of the 
event being counted. The count value is frozen on a valid branch 
monitoring triggering condition (in which case CntrHitO will also be set). 
This is an 8-bit signed value (2's complement). 


Heuristic events which only increment will saturate and freeze at 
maximum value OxFF (256). 

RET-CALL event counter saturate at maximum value Ox7F (+127) and 
minimum value 0x80 (-128). 


47:40 Count1 


The current value of counter 1 updated after each occurrence of the 
event being counted. The count value is frozen on a valid branch 
monitoring triggering condition (in which case CntrHit1 will also be set). 
This is an 8-bit signed value (2's complement). 


Heuristic events which only increment will saturate and freeze at 
maximum value OxFF (256). 

RET-CALL event counter saturate at maximum value Ox7F (+127) and 
minimum value Ox80 (-128). 


63:48 Reserved. 


Register Address: 354H—355H, 852-853 | MSR_BR_DETECT_COUNTER_CONFIG_i 


Branch Monitoring Detect Counter Configuration (R/W) 


0 CntrEn 
Enable counter. 
7:1 CntrEvSel 


Event select (other values #GP) 
‘0000000 = RETs. 

‘0000001 = RET-CALL bias. 

‘0000010 = RET mispredicts. 

‘0000011 = Branch (all) mispredicts. 
‘0000100 = Indirect branch mispredicts. 
‘0000101 = Far branch instructions. 


14:8 CntrThreshold 


Threshold (an unsigned value of 0 to 127 supported). The value O of 
counter threshold will result in event signaled after every instruction. 
#GP if threshold is < 2. 


2-358 Vol. 4 


Table 2-42. Additional MSRs Supported by the 8th Generation Intel® Core™ i3 Processors 
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Based on Cannon Lake Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
15 MispredEventCnt 
Mispredict events counting behavior: 
‘O = Mispredict events are counted in a window. 
1 = Mispredict events are counted based on a consecutive occurrence. 
CntrThreshold is treated as # of consecutive mispredicts. This control 
bit only applies to events specified by CntrEvSel that involve a 
prediction (0000010, 000001 1, 0000100). Setting this bit for other 
events is ignored. 
63:16 Reserved. 
Register Address: 3F8H, 1016 MSR_PKG_C3_RESIDENCY 
Package C3 Residency Counter (R/O) Package 
63:0 Note: C-state values are processor specific C-state code names, 
unrelated to MWAIT extension C-state parameters or ACPI C-states. 
Register Address: 620H, 1568 MSR_RING_RATIO_LIMIT 
Ring Ratio Limit (R/W) Package 
This register provides Min/Max Ratio Limits for the LLC and Ring. 
6:0 MAX_Ratio 
This field is used to limit the max ratio of the LLC/Ring. 
7 Reserved. 
148 MIN_Ratio 
Writing to this field controls the minimum possible ratio of the 
LLC/Ring. 
63:15 Reserved. 
Register Address: 660H, 1632 MSR_CORE_C1_RESIDENCY 
Core C1 Residency Counter (R/O) Core 
63:0 Value since last reset for the Core C1 residency. Counter rate is the 
Max Non-Turbo frequency (same as TSC). This counter counts in case 
both of the core’s threads are in an idle state and at least one of the 
core’s thread residency is in a C1 state or in one of its sub states. The 
counter is updated only after a core C state exit. Note: Always reads 0 
if core C1 is unsupported. A value of zero indicates that this processor 
does not support core C1 or never entered core C1 level state. 
Register Address: 662H, 1634 MSR_CORE_C3_RESIDENCY 
Core C3 Residency Counter (R/O) Core 


63:0 


Will always return 0. 


Table 2-43 lists the MSRs of uncore PMU for Intel processors with a CPUID Signature DisplayFamily_DisplayModel 


value of 06_66H. 
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Table 2-43. Uncore PMU MSRs Supported by Intel® Core” Processors Based on Cannon Lake Microarchitecture 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 394H, 916 MSR_UNC_PERF_FIXED_CTRL 
Uncore Fixed Counter Control (R/W) Package 
19:0 Reserved. 
20 Enable overflow propagation. 
21 Reserved 
22 Enable counting. 
63:23 Reserved. 
Register Address: 395H, 917 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
47:0 Current count. 
63:48 Reserved. 
Register Address: 396H, 918 MSR_UNC_CBO_CONFIG 
Uncore C-Box Configuration Information (R/O) Package 
3:0 Report the number of C-Box units with performance counters, including 

processor cores and processor graphics. 

63:4 Reserved. 
Register Address: 3BOH, 946 MSR_UNC_ARB_PERFCTRO 
Uncore Arb Unit, Performance Counter O Package 
Register Address: 3B1H, 947 MSR_UNC_ARB_PERFCTR1 
Uncore Arb Unit, Performance Counter 1 Package 
Register Address: 3B2H, 944 MSR_UNC_ARB_PERFEVTSELO 
Uncore Arb Unit, Counter O Event Select MSR Package 
Register Address: 3B3H, 945 MSR_UNC_ARB_PERFEVTSEL1 
Uncore Arb unit, Counter 1 Event Select MSR Package 
Register Address: 700H, 1792 MSR_UNC_CBO_0_PERFEVTSELO 
Uncore C-Box 0, Counter O Event Select MSR Package 
Register Address: 701H, 1793 MSR_UNC_CBO_O_PERFEVTSEL1 
Uncore C-Box 0, Counter 1 Event Select MSR Package 
Register Address: 702H, 1794 MSR_UNC_CBO_0_PERFCTRO 
Uncore C-Box 0, Performance Counter O Package 
Register Address: 703H, 1795 MSR_UNC_CBO_O_PERFCTR1 
Uncore C-Box 0, Performance Counter 1 Package 
Register Address: 708H, 1800 MSR_UNC_CBO_1_PERFEVTSELO 
Uncore C-Box 1, Counter O Event Select MSR Package 
Register Address: 709H, 1801 MSR_UNC_CBO_1_PERFEVTSEL1 
Uncore C-Box 1, Counter 1 Event Select MSR Package 
Register Address: 70AH, 1802 MSR_UNC_CBO_1_PERFCTRO 
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Table 2-43. Uncore PMU MSRs Supported by Intel® Core™ Processors Based on Cannon Lake Microarchitecture 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 1, Performance Counter 0 Package 
Register Address: 70BH, 1803 MSR_UNC_CBO_1_PERFCTR1 
Uncore C-Box 1, Performance Counter 1 Package 
Register Address: 710H, 1808 MSR_UNC_CBO_2_PERFEVTSELO 
Uncore C-Box 2, Counter O Event Select MSR Package 
Register Address: 711H, 1809 MSR_UNC_CBO_2_PERFEVTSEL1 
Uncore C-Box 2, Counter 1 Event Select MSR Package 
Register Address: 712H, 1810 MSR_UNC_CBO_2_PERFCTRO 
Uncore C-Box 2, Performance Counter 0 Package 
Register Address: 713H, 1811 MSR_UNC_CBO_2_PERFCTR1 
Uncore C-Box 2, Performance Counter 1 Package 
Register Address: 718H, 1816 MSR_UNC_CBO_3_PERFEVTSELO 
Uncore C-Box 3, Counter O Event Select MSR Package 
Register Address: 719H, 1817 MSR_UNC_CBO_3_PERFEVTSEL1 
Uncore C-Box 3, Counter 1 Event Select MSR Package 
Register Address: 71AH, 1818 MSR_UNC_CBO_3_PERFCTRO 
Uncore C-Box 3, Performance Counter 0 Package 
Register Address: 71BH, 1819 MSR_UNC_CBO_3_PERFCTR1 
Uncore C-Box 3, Performance Counter 1 Package 
Register Address: 720H, 1824 MSR_UNC_CBO_4_PERFEVTSELO 
Uncore C-Box 4, Counter O Event Select MSR Package 
Register Address: 721H, 1825 MSR_UNC_CBO_4_PERFEVTSEL1 
Uncore C-Box 4, Counter 1 Event Select MSR Package 
Register Address: 722H, 1826 MSR_UNC_CBO_4_PERFCTRO 
Uncore C-Box 4, Performance Counter 0 Package 
Register Address: 723H, 1827 MSR_UNC_CBO_4_PERFCTR1 
Uncore C-Box 4, Performance Counter 1 Package 
Register Address: 728H, 1832 MSR_UNC_CBO_5_PERFEVTSELO 
Uncore C-Box 5, Counter O Event Select MSR Package 
Register Address: 729H, 1833 MSR_UNC_CBO_5_PERFEVTSEL1 
Uncore C-Box 5, Counter 1 Event Select MSR Package 
Register Address: 72AH, 1834 MSR_UNC_CBO_5_PERFCTRO 
Uncore C-Box 5, Performance Counter 0 Package 
Register Address: 72BH, 1835 MSR_UNC_CBO_5_PERFCTR1 
Uncore C-Box 5, Performance Counter 1 Package 
Register Address: 730H, 1840 MSR_UNC_CBO_6_PERFEVTSELO 
Uncore C-Box 6, Counter O Event Select MSR Package 
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Table 2-43. Uncore PMU MSRs Supported by Intel® Core” Processors Based on Cannon Lake Microarchitecture 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 731H, 1841 MSR_UNC_CBO_6_PERFEVTSEL1 
Uncore C-Box 6, Counter 1 Event Select MSR Package 
Register Address: 732H, 1842 MSR_UNC_CBO_6_PERFCTRO 
Uncore C-Box 6, Performance Counter 0 Package 
Register Address: 733H, 1843 MSR_UNC_CBO_6_PERFCTR1 
Uncore C-Box 6, Performance Counter 1 Package 
Register Address: 738H, 1848 MSR_UNC_CBO_7_PERFEVTSELO 
Uncore C-Box 7, Counter O Event Select MSR Package 
Register Address: 739H, 1849 MSR_UNC_CBO_7_PERFEVTSEL1 
Uncore C-Box 7, Counter 1 Event Select MSR Package 
Register Address: 73AH, 1850 MSR_UNC_CBO_7_PERFCTRO 
Uncore C-Box 7, Performance Counter 0 Package 
Register Address: 73BH, 1851 MSR_UNC_CBO_7_PERFCTR1 
Uncore C-Box 7, Performance Counter 1 Package 
Register Address: E01H, 3585 MSR_UNC_PERF_GLOBAL_CTRL 
Uncore PMU Global Control Package 
0 Slice O select. 
1 Slice 1 select. 
2 Slice 2 select. 
3 Slice 3 select. 
4 Slice 4select. 
18:5 Reserved. 
29 Enable all uncore counters. 
30 Enable wake on PMI. 
31 Enable Freezing counter when overflow. 
63:32 Reserved. 
Register Address: E02H, 3586 MSR_UNC_PERF_GLOBAL_STATUS 
Uncore PMU Main Status Package 
0 Fixed counter overflowed. 
1 An ARB counter overflowed. 
2 Reserved. 
3 A CBox counter overflowed (on any slice). 
63:4 Reserved. 


2.17.3. MSRs Introduced in 10th Generation Intel® Core™ Processors 
Table 2-44 lists additional MSRs for 10th generation Intel Core processors with a CPUID Signature 


DisplayFamily_DisplayModel value of 06_7DH or 06_7EH. For an MSR listed in Table 2-44 that also appears in the 


model-specific tables of prior generations, Table 2-44 supersede prior generation tables. 
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Table 2-44. MSRs Supported by the 10th Generation Intel® Core™ Processors (Ice Lake Microarchitecture) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 33H, 51 MSR_MEMORY_CTRL 
Memory Control Register Core 
28:0 Reserved. 
29 SPLIT_LOCK_DISABLE 
If set to 1, a split lock will cause an #AC(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 
30 Reserved. 
31 Reserved. 
Register Address: 48H, 72 IA32_SPEC_CTRL 
See Table 2-2. Core 
Register Address: 49H, 73 IA32_PREDICT_CMD 
See Table 2-2. Thread 
Register Address: 8CH, 140 IA32_SGXLEPUBKEYHASHO 
See Table 2-2. Thread 
Register Address: 8DH, 141 IA32_SGXLEPUBKEYHASH1 
See Table 2-2. Thread 
Register Address: 8EH, 142 IA32_SGXLEPUBKEYHASH2 
See Table 2-2. Thread 
Register Address: 8FH, 143 IA32_SGXLEPUBKEYHASH3 
See Table 2-2. Thread 
Register Address: AOH, 160 MSR_BIOS_MCU_ERRORCODE 
BIOS MCU ERRORCODE (R/O) Package 
This MSR indicates if WRMSR 0x79 failed to configure PRM memory and gives a hint to debug BIOS. 
15:0 Error Codes (R/O) Package 
30:16 Reserved. 
31 MCU Partial Success (R/O) Thread 
When set to 1, WRMSR 0x79 skipped part of the functionality during 
BIOS. 
Register Address: A5H, 165 MSR_FIT_BIOS_ERROR 
FIT BIOS ERROR (R/W) Thread 


Report error codes for debug in case the processor failed to parse the Firmware Table in BIOS. 


Can also be used to log BIOS information. 


7:0 Error Codes (R/W) 
Error codes for debug. 

15:8 Entry Type (R/W) 
Failed FIT entry type. 

16 FIT MCU Entry (R/W) 


FIT contains MCU entry. 
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Table 2-44. MSRs Supported by the 10th Generation Intel® Core™ Processors (Ice Lake Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
62:17 Reserved. 
63 LOCK (R/W) 

When set to 1, writes to this MSR will be skipped. 

Register Address: 10BH, 267 IA32_FLUSH_CMD 
See Table 2-2. Thread 
Register Address: 151H, 337 MSR_BIOS_DONE 
BIOS Done (R/WO) Thread 
0 BIOS Done Indication (R/WO) Thread 


Set by BIOS when it finishes programming the processor and wants to 
lock the memory configuration from changes by software that is running 
on this thread. 


Writes to the bit will be ignored if EAX[0] is 0. 


1 Package BIOS Done Indication (R/O) Package 
When set to 1, all threads in the package have bit O of this MSR set. 

31:2 Reserved. 

Register Address: 1F1H, 497 MSR_CRASHLOG_CONTROL 

Write Data to a Crash Log Configuration Thread 

0 CDDIS: CrashDump_Disable 
If set, indicates that Crash Dump is disabled. 

63:1 Reserved. 

Register Address: 2AQH, 672 MSR_PRMRR_BASE_O 

Processor Reserved Memory Range Register - Physical Base Control Register (R/W) Core 

2:0 MEMTYPE: PRMRR BASE Memory Type. 

3 CONFIGURED: PRMRR BASE Configured. 

11:4 Reserved. 

51:12 BASE: PRMRR Base Address. 

63:52 Reserved. 

Register Address: 30CH, 780 IA32_FIXED_CTR3 

Fixed-Function Performance Counter Register 3 (R/W) Thread 

Bit definitions are the same as found in [A32_FIXED_CTRO, offset 309H. See Table 2-2. 

Register Address: 329H, 809 MSR_PERF_METRICS 

Performance Metrics (R/W) Thread 


Reports metrics directly. Software can check (and/or expose to its guests) the availability of PERF_METRICS feature 
using IA32_PERF_CAPABILITIES.PERF_METRICS_AVAILABLE (bit 15). 


7:0 Retiring. Percent of utilized slots by uops that eventually retire (commit). 


15:8 Bad Speculation. Percent of wasted slots due to incorrect speculation, 
covering utilized by uops that do not retire, or recovery bubbles 
(unutilized slots). 


23:16 Frontend Bound. Percent of unutilized slots where front-end did not 
deliver a uop while back-end is ready. 
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Table 2-44. MSRs Supported by the 10th Generation Intel® Core™ Processors (Ice Lake Microarchitecture) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
31:24 Backend Bound. Percent of unutilized slots where a uop was not delivered 
to back-end due to lack of back-end resources. 
63:25 Reserved. 
Register Address: 3F2H, 1010 MSR_PEBS_DATA_CFG 
PEBS Data Configuration (R/W) Thread 
Provides software the capability to select data groups of interest and thus reduce the record size in memory and 
record generation latency. Hence, a PEBS record's size and layout vary based on the selected groups. The MSR also 
allows software to select LBR depth for branch data records. 
0 Memory Info. 
Setting this bit will capture memory information such as the linear 
address, data source and latency of the memory access in the PEBS 
record. 
1 GPRs. 
Setting this bit will capture the contents of the General Purpose registers 
in the PEBS record. 
2 XMMs. 
Setting this bit will capture the contents of the XMM registers in the PEBS 
record. 
3 LBRs. 
Setting this bit will capture LBR TO, FROM, and INFO in the PEBS record. 
23:4 Reserved. 
31:24 LBR Entries. 
Set the field to the desired number of entries - 1. For example, if the 
LBR_entries field is 0, a single entry will be included in the record. To 
include 32 LBR entries, set the LBR_entries field to 31 (0x1F). To ensure 
all PEBS records are 16-byte aligned, software can use LBR_entries that 
is multiple of 3. 
Register Address: 541H, 1345 MSR_CORE_UARCH_CTL 
Core Microarchitecture Control MSR (R/W) Core 
0 L1 Scrubbing Enable 
When set to 1, enable L1 scrubbing. 
31:1 Reserved. 
Register Address: 657H, 1623 MSR_FAST_UNCORE_MSRS_CTL 
Fast WRMSR/RDMSR Control MSR (R/W) Thread 
3:0 FAST_ACCESS_ENABLE: 
Bit 0: When set to ‘1’, provides a hint for the hardware to enable fast 
access mode for the [A32_HWP_REQUEST MSR. 
This bit is sticky and is cleaned by the hardware only during reset time. 
This bit is valid only if FAST_UNCORE_MSRS_CAPABILITY[0] is set. Setting 
this bit will cause CPUID[6].EAX[18] to be set. 
31:4 Reserved. 
Register Address: 65€H, 1630 MSR_FAST_UNCORE_MSRS_STATUS 
Indication of Uncore MSRs, Post Write Activates Thread 
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Table 2-44. MSRs Supported by the 10th Generation Intel® Core™ Processors (Ice Lake Microarchitecture) (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
0 Indicates whether the CPU is still in the middle of writing 


IA32_HWP_REQUEST MSR, even after the WRMSR instruction has retired. 
A value of 1 indicates the last write of IA32_HWP_REQUEST is still 
ongoing. 

A value of 0 indicates the last write of [A32_HWP_REQUEST is visible 
outside the logical processor. 


Software can use the status of this bit to avoid overwriting 
IA32_HWP_REQUEST. 


31:1 Reserved. 

Register Address: 65FH, 1631 MSR_FAST_UNCORE_MSRS_CAPABILITY 

Fast WRMSR/RDMSR Enumeration MSR (R/O) Thread 
3:0 MSRS_CAPABILITY: 


Bit 0: If set to ‘1’, hardware supports the fast access mode for the 
IA32_HWP_REQUEST MSR. 


31:4 Reserved. 

Register Address: 772H, 1906 IA32_HWP_REQUEST_PKG 

See Table 2-2. Package 
Register Address: 775H, 1909 IA32_PECI_HWP_REQUEST_INFO 

See Table 2-2. Thread 
Register Address: 777H, 1911 IA32_HWP_STATUS 

See Table 2-2. Thread 


2.17.4 MSRs Introduced in the 11th Generation Intel® Core™ Processors based on Tiger Lake 
Microarchitecture 


Table 2-45 lists additional MSRs for 11th generation Intel Core processors with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_8CH or 06_8DH. The MSRs listed in Table 2-44 are also supported by 
these processors. For an MSR listed in Table 2-45 that also appears in the model-specific tables of prior genera- 
tions, Table 2-45 supersedes prior generation tables. 


Table 2-45. Additional MSRs Supported by the 11th Generation Intel® Core™ Processors Based on Tiger Lake 
Microarchitecture 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: AQH, 160 MSR_BIOS_MCU_ERRORCODE 
BIOS MCU ERRORCODE (R/O) Package 
15:0 Error Codes 
31:16 Reserved. 
Register Address: A7H, 167 MSR_BIOS_DEBUG 
BIOS DEBUG (R/O) Thread 
This MSR indicates if WRMSR 79H failed to configure PRM memory and gives a hint to debug BIOS. 
30:0 Reserved. 
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Table 2-45. Additional MSRs Supported by the 11th Generation Intel® Core™ Processors Based on Tiger Lake 


Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 

31 MCU Partial Success 
When set to 1, WRMSR 79H skipped part of the functionality during 
BIOS. 

63:32 Reserved. 

Register Address: CFH, 207 IA32_CORE_CAPABILITIES 

1A32 Core Capabilities Register (R/O) Package 

If CPUID.(EAX=07H, ECX=0):EDX[30] = 1. 

This MSR provides an architectural enumeration function for model-specific behavior. 

1:0 Reserved. 

2 FUSA_SUPPORTED 

3 RSM_IN_CPLO_ONLY 
When set to 1, the RSM instruction is only allowed in CPLO (#GP 
triggered in any CPL != 0). 
When set to 0, then any CPL may execute the RSM instruction. 

4 Reserved. 

5 SPLIT_LOCK_DISABLE_SUPPORTED 
When read as 1, software can set bit 29 of MSR_-MEMORY_CTRL 
(MSR address 33H). 

31:6 Reserved. 

Register Address: 492H, 1170 IA32_VMX_PROCBASED_CTLS3 

IA32_VMX_PROCBASED_CTLS3 Core 

This MSR enumerates the allowed 1-settings of the third set of processor-based controls. Specifically, VM entry 

allows bit X of the tertiary processor-based VM-execution controls to be 1 if and only if bit X of the MSR is set to 1. 

If bit X of the MSR is cleared to 0, VM entry fails if control X and the “activate tertiary controls” primary processor- 

based VM-execution control are both 1. 

0 LOADIWKEY 
This control determines whether executions of LOADIWKEY cause VM 
exits. 

63:1 Reserved. 

Register Address: 601H, 1537 MSR_VR_CURRENT_CONFIG 

Power Limit 4 (PL4) Package 

Package-level maximum power limit (in Watts). It is a proactive, instantaneous limit. 

12:0 PL4 Value 
PL4 value in 0.125 A increments. This field is locked by 
VR_CURRENT_CONFIG[LOCK]. When the LOCK bit is set to 1b, this 
field becomes Read Only. 

30:13 Reserved. 

31 Lock Indication (LOCK) 
This bit will lock the CURRENT_LIMIT settings in this register and will 
also lock this setting. This means that once set to 1b, the 
CURRENT_LIMIT setting and this bit become Read Only until the next 
Warm Reset. 
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Table 2-45. Additional MSRs Supported by the 11th Generation Intel® Core™ Processors Based on Tiger Lake 


Microarchitecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
62:32 Not in use. 
63 Reserved. 
Register Address: 6AOH, 1696 IA32_U_CET 
Configure User Mode CET (R/W) 
See Table 2-2. 
Register Address: 6A2H, 1698 IA32_S_CET 
Configure Supervisor Mode CET (R/W) 
See Table 2-2. 
Register Address: 6A4H, 1700 IA32_PLO_SSP 
Linear address to be loaded into SSP on transition to privilege level 0. (R/W) 
See Table 2-2. 
Register Address: 6A5H, 1701 IA32_PL1_SSP 
Linear address to be loaded into SSP on transition to privilege level 1. (R/W) 
See Table 2-2. 
Register Address: 6A6H, 1702 IA32_PL2_SSP 
Linear address to be loaded into SSP on transition to privilege level 2. (R/W) 
See Table 2-2. 
Register Address: 6A7H, 1703 IA32_PL3_SSP 
Linear address to be loaded into SSP on transition to privilege level 3. (R/W) 
See Table 2-2. 
Register Address: 6A8H, 1704 IA32_INTERRUPT_SSP_TABLE_ADDR 
Linear address of a table of seven shadow stack pointers that are selected in [A-32e mode using the IST index (when 
not O) from the interrupt gate descriptor. (R/W) 
See Table 2-2. 
Register Address: 981H, 2433 IA32_TME_CAPABILITY 
See Table 2-2. 
Register Address: 982H, 2434 IA32_TME_ACTIVATE 
See Table 2-2. 
Register Address: 983H, 2435 IA32_TME_EXCLUDE_MASK 
See Table 2-2. 
Register Address: 984H, 2436 IA32_TME_EXCLUDE_BASE 
See Table 2-2. 
Register Address: 990H, 2448 |[A32_COPY_STATUS! 
See Table 2-2. Thread 
Register Address: 991H, 2449 I[A32_IWKEYBACKUP_STATUS 
See Table 2-2. Platform 
Register Address: C82H, 3202 IA32_L2_QOS_CFG 
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Table 2-45. Additional MSRs Supported by the 11th Generation Intel® Core™ Processors Based on Tiger Lake 
Microarchitecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
IA32_CR_L2_QOS_CFG Core 


This MSR provides software an enumeration of the parameters that L2 QoS (Intel RDT) support in any particular 
implementation. 

0 CDP_ENABLE 

When set to 1, it will enable the code and data prioritization for the 
L2 CAT/Intel RDT feature. 


When set to 0, code and data prioritization is disabled for L2 CAT/Intel 
RDT. See Chapter 18, “Debug, Branch Profile, TSC, and Intel® Resource 
Director Technology (Intel? RDT) Features,” for further details on CDP. 


31:1 Reserved. 
Register Address: D1OH—D17H, 3220-3351 | IA32_L2_QOS_MASK_[0-7] 
IA32_CR_L2_QOS_MASK_[0-7] Package 


Controls MLC (L2) Intel RDT allocation. For more details on CAT/RDT, see Chapter 18, “Debug, Branch Profile, TSC, and 
Intel? Resource Director Technology (Intel? RDT) Features.” 


19:0 WAYS_MASK 


Setting a 1 in this bit X allows threads with CLOS <n> (where N is [0- 
7]) to allocate to way X in the MLC. Ones are only allowed to be 
written to ways that physically exist in the MLC 

(CPUID.4.2:EBX[3 1:22] will indicate this). 


Writing a 1 to a value beyond the highest way or a non-contiguous 
set of 1s will cause a #GP on the WRMSR to this MSR. 


31:20 Reserved. 

Register Address: D91H, 3473 IA32_COPY_LOCAL_TO_PLATFORM! 

See Table 2-2. Thread 

Register Address: D92H, 3474 IA32_COPY_PLATFORM_TO_LOCAL! 

See Table 2-2. Thread 
NOTES: 


1. Further details on Key Locker and usage of this MSR can be found here: 
https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html. 


2.17.5 MSRs Introduced in the 12th and 13th Generation Intel® Core™ Processors Supporting 
Performance Hybrid Architecture 
Table 2-46 lists additional MSRs for 12th and 13th generation Intel Core processors with a CPUID Signature 


DisplayFamily_DisplayModel value of 06_97H, 06_9AH, 06_BAH, 06_B7H, or 06_BFH. Table 2-47 lists the MSRs 
unique to the processor P-core. Table 2-48 lists the MSRs unique to the processor E-core. 


The MSRs listed in Table 2-44! and Table 2-45 are also supported by these processors. For an MSR listed in Table 
2-46, Table 2-47, or Table 2-48 that also appears in the model-specific tables of prior generations, Table 2-46, 
Table 2-47, and Table 2-48 supersede prior generation tables. 


1. MSRs at the following addresses are not supported in the 12th and 13th generation Intel Core processor E-core: 30CH, 329H, 541H, 
and 657H. The MSR at address 657H is not supported in the 12th and 13th generation Intel Core processor P-core. 
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Table 2-46. Additional MSRs Supported by the 12th and 13th Generation Intel® Core™ Processors Supporting 
Performance Hybrid Architecture 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 33H, 51 MSR_MEMORY_CTRL 
Memory Control Register Core 
26:0 Reserved. 
27 UC_STORE_THROTTLE 


If set to 1, when enabled, the processor will only allow one in- 
progress UC store at a time. 


28 UC_LOCK_DISABLE 

If set to 1, a UC lock will cause a #GP(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 
29 SPLIT_LOCK_DISABLE 

If set to 1, a split lock will cause an #AC(0) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 


30 Reserved. 

31 Reserved. 

Register Address: BCH, 188 IA32_MISC_PACKAGE_CTLS 

Power Filtering Control (R/W) Package 
IA32_ARCH_CAPABILITIES[bit 10] enumerates support for this MSR. 

See Table 2-2. 

Register Address: C7H, 199 IA32_PMC6 

General Performance Counter 6 (R/W) Core 
See Table 2-2. 

Register Address: C8H, 200 IA32_PMC7 

General Performance Counter 7 (R/W) Core 
See Table 2-2. 

Register Address: CFH, 207 IA32_CORE_CAPABILITIES 

IA32 Core Capabilities Register (R/O) Package 


If CPUID.(EAX=07H, ECX=0):EDX[30] = 1. 
This MSR provides an architectural enumeration function for model-specific behavior. 
0 STLB_QOS_SUPPORTED 


When set to 1, the STLB QoS feature is supported and the STLB 
QoS MSRs (1A8FH -1A97H) are accessible. When set to 0, access 
to these MSRs will #GP. 


1 Reserved. 
FUSA_SUPPORTED 


RSM_IN_CPLO_ONLY 


When set to 1, the RSM instruction is only allowed in CPLO (#GP 
triggered in any CPL != 0). 


When set to O, then any CPL may execute the RSM instruction. 
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Table 2-46. Additional MSRs Supported by the 12th and 13th Generation Intel® Core™ Processors Supporting 
Performance Hybrid Architecture (Contd.) 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 


4 UC_LOCK_DISABLE_SUPPORTED 


When read as 1, software can set bit 28 of MSR_-MEMORY_CTRL 
(MSR address 33H). 


5 SPLIT_LOCK_DISABLE_SUPPORTED 
When read as 1, software can set bit 29 of MSR_-MEMORY_CTRL. 
6 SNOOP_FILTER_QOS_SUPPORTED 


When set to 1, the Snoop Filter Qos Mask MSRs are supported. 
When set to O, access to these MSRs will #GP. 


7 UC_STORE_THROTTLING_SUPPORTED 


When set 1, UC Store throttle capability exist through 
MSR_MEMORY_CTRL (33H) bit 27. 


31:8 Reserved. 

Register Address: 1H, 225 IA32_UMWAIT_CONTROL 

UMWAIT Control (R/W) 

See Table 2-2. 

Register Address: 10AH, 266 IA32_ARCH_CAPABILITIES 

Enumeration of Architectural Features (R/O) 

See Table 2-2. 

Register Address: 18CH, 396 IA32_PERFEVTSEL6 

See Table 2-20. Core 
Register Address: 18DH, 397 IA32_PERFEVTSEL7 

See Table 2-20. Core 
Register Address: 195H, 405 IA32_OVERCLOCKING_STATUS 

Overclocking Status (R/O) Package 
IA32_ARCH_CAPABILITIES[bit 23] enumerates support for this MSR. See Table 2-2. 

Register Address: 1ADH, 429 MSR_PRIMARY_TURBO_RATIO_LIMIT 

Primary Maximum Turbo Ratio Limit (R/W) Package 


Software can configure these limits when MSR_PLATFORM_INFO[28] = 1. Specifies Maximum Ratio Limit for each 
group. Maximum ratio for groups with more cores must decrease monotonically. 


7:0 MAX_TURBO_GROUP_O: 

Maximum turbo ratio limit with 1 core active. 
15:8 MAX_TURBO_GROUP_1: 

Maximum turbo ratio limit with 2 cores active. 
23:16 MAX_TURBO_GROUP_2: 

Maximum turbo ratio limit with 3 cores active. 
31:24 MAX_TURBO_GROUP_3: 

Maximum turbo ratio limit with 4 cores active. 
39:32 MAX_TURBO_GROUP_4: 

Maximum turbo ratio limit with 5 cores active. 
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Table 2-46. Additional MSRs Supported by the 12th and 13th Generation Intel® Core™ Processors Supporting 
Performance Hybrid Architecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
47:40 MAX_TURBO_GROUP_5: 
Maximum turbo ratio limit with 6 cores active. 
55:48 MAX_TURBO_GROUP_6: 
Maximum turbo ratio limit with 7 cores active. 
63:56 MAX_TURBO_GROUP_7: 
Maximum turbo ratio limit with 8 cores active. 
Register Address: 493H, 1171 IA32_WMX_EXIT_CTLS2 
See Table 2-2. 
Register Address: 4C7H, 1223 IA32_A_PMC6 
Full Width Writable IA32_PMC6 Alias (R/W) 
See Table 2-2. 
Register Address: 4C8H, 1224 IA32_A_PMC7 
Full Width Writable [A32_PMC7 Alias (R/W) 
See Table 2-2. 
Register Address: 650H, 1616 MSR_SECONDARY_TURBO_RATIO_LIMIT 
Secondary Maximum Turbo Ratio Limit (R/W) Package 


Software can configure these limits when MSR_PLATFORM_INFO[28] = 1. 


Specifies Maximum Ratio Limit for each group. Maximum ratio for groups with more cores must decrease 
monotonically. 


7:0 MAX_TURBO_GROUP_0O: 

Maximum turbo ratio limit with 1 core active. 
15:8 MAX_TURBO_GROUP_1: 

Maximum turbo ratio limit with 2 cores active. 
23:16 MAX_TURBO_GROUP_2: 

Maximum turbo ratio limit with 3 cores active. 
31:24 MAX_TURBO_GROUP_3: 

Maximum turbo ratio limit with 4 cores active. 
39:32 MAX_TURBO_GROUP_4: 

Maximum turbo ratio limit with 5 cores active. 
47:40 MAX_TURBO_GROUP_5S: 

Maximum turbo ratio limit with 6 cores active. 
55:48 MAX_TURBO_GROUP_6: 

Maximum turbo ratio limit with 7 cores active. 
63:56 MAX_TURBO_GROUP_7: 

Maximum turbo ratio limit with 8 cores active. 
Register Address: 664H, 1636 MSR_MC6_RESIDENCY_COUNTER 
Module C6 Residency Counter (R/O) Module 


Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-States. 


2-372 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-46. Additional MSRs Supported by the 12th and 13th Generation Intel® Core™ Processors Supporting 
Performance Hybrid Architecture (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
63:0 Time that this module is in module-specific C6 states since last 
reset. Counts at 1 Mhz frequency. 
Register Address: 6€1H, 1761 IA32_PKRS 
Specifies the PK permissions associated with each protection domain for supervisor pages (R/W) 
See Table 2-2. 
Register Address: 776H, 1910 IA32_HWP_CTL 
See Table 2-2. 
Register Address: 981H, 2433 IA32_TME_CAPABILITY 
Memory Encryption Capability MSR 
See Table 2-2. 
Register Address: 1200H—121FH, 4608—4639 | IA32_LBR_x_INFO 


Last Branch Record Entry X Info Register (R/W) 


See Table 2-2. 

Register Address: 14CEH, 5326 IA32_LBR_CTL 
Last Branch Record Enabling and Configuration Register (R/W) 

See Table 2-2. 

Register Address: 14CFH, 5327 IA32_LBR_DEPTH 
Last Branch Record Maximum Stack Depth Register (R/W) 

See Table 2-2. 


IA32_LBR_x_FROM_IP 


Register Address: 1500H—151FH, 5376—5407 


Last Branch Record Entry X Source IP Register (R/W) 
See Table 2-2. 


IA32_LBR_x_TO_IP 


Register Address: 1600H—161FH, 5632—5663 


Last Branch Record Entry X Destination IP Register (R/W) 
See Table 2-2. 


Register Address: 17D2H, 6098 IA32_THREAD_FEEDBACK_CHAR 


Thread Feedback Characteristics (R/O) 
See Table 2-2. 


Register Address: 17D4H, 6100 IA32_HW_FEEDBACK_THREAD_CONFIG 


Hardware Feedback Thread Configuration (R/W) 
See Table 2-2. 


Register Address: 17DAH, 6106 IA32_HRESET_ENABLE 


History Reset Enable (R/W) 
See Table 2-2. 


The MSRs listed in Table 2-47 are unique to the 12th and 13th generation Intel Core processor P-core. These MSRs 
are not supported on the processor E-core. 
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Table 2-47. MSRs Supported by 12th and 13th Generation Intel® Core™ Processor P-core 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 1A4H, 420 MSR_PREFETCH_CONTROL 
Prefetch Disable Bits (R/W) 
0 L2_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L2 hardware prefetcher, which fetches additional 
lines of code or data into the L2 cache. 


1 L2_ADJACENT_CACHE_LINE_PREFETCHER_DISABLE 


If 1, disables the adjacent cache line prefetcher, which fetches the 
cache line that comprises a cache line pair (128 bytes). 


2 DCU_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L1 data cache prefetcher, which fetches the next 
cache line into L1 data cache. 


3 DCU_IP_PREFETCHER_DISABLE 


If 1, disables the L1 data cache IP prefetcher, which uses sequential 
load history (based on instruction pointer of previous loads) to 
determine whether to prefetch additional lines. 


Reserved. 


AMP_PREFETCH_DISABLE 
If 1, disables the L2 Adaptive Multipath Probability (AMP) prefetcher. 


63:6 Reserved. 

Register Address: 3F7H, 1015 MSR_PEBS_FRONTEND 

FrontEnd Precise Event Condition Select (R/W) Thread 
See Table 2-39. 

Register Address: 540H, 1344 MSR_THREAD_UARCH_CTL 

Thread Microarchitectural Control (R/W) Thread 
0 WB_MEM_STRM_LD_DISABLE 


Disable streaming behavior for MOVNTDQA loads to WB memory 
type. If set, these accesses will be treated like regular cacheable 
loads (Data will be cached). 


63:1 Reserved. 
Register Address: 541H, 1345 MSR_CORE_UARCH_CTL 
Core Microarchitecture Control MSR (R/W) Core 


See Table 2-44. 


Register Address: DIOH—D17H, 3220-3351 | IA32_L2_QOS_MASK_[0-7] 
IA32_CR_L2_QOS_MASK_[0-7] Core 
If CPUID(EAX=10H, ECX=1):EDX.COS_MAX[15:0] = 0. 


Controls MLC (L2) Intel RDT allocation. For more details on CAT/RDT, see Chapter 18, “Debug, Branch Profile, TSC, and 
Intel? Resource Director Technology (Intel® RDT) Features.” 
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Table 2-47. MSRs Supported by 12th and 13th Generation Intel® Core™ Processor P-core 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


19:0 WAYS_MASK 


Setting a 1 in this bit X allows threads with CLOS <n> (where N is [0- 
7)) to allocate to way X in the MLC. Ones are only allowed to be 
written to ways that physically exist in the MLC 
(CPUID.4.2:EBX[31:22] will indicate this). 


Writing a 1 to a value beyond the highest way or a non-contiguous 
set of 1s will cause a #GP on the WRMSR to this MSR. 


31:20 Reserved. 


The MSRs listed in Table 2-48 are unique to the 12th and 13th generation Intel Core processor E-core. These MSRs 


are not supported on the processor P-core. 


Table 2-48. MSRs Supported by 12th and 13th Generation Intel® Core™ Processor E-core 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: DIOH—D1FH, 3220—3359 IA32_L2_QOS_MASK_[0-15] 
IA32_CR_L2_QOS_MASK_[0-15] Module 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] 2 0. 
Controls MLC (L2) Intel RDT allocation. For more details on CAT/RDT, see Chapter 18, “Debug, Branch Profile, TSC, and 
Intel® Resource Director Technology (Intel? RDT) Features.” 
19:0 WAYS_MASK 
Setting a 1 in this bit X allows threads with CLOS <n> (where N 
is [0-7]) to allocate to way X in the MLC. Ones are only allowed to 
be written to ways that physically exist in the MLC 
(CPUID.4.2:EBX[3 1:22] will indicate this). 
Writing a 1 to a value beyond the highest way or a non- 
contiguous set of 1s will cause a #GP on the WRMSR to this MSR. 
31:20 Reserved. 
Register Address: 1309H—130BH, 4873 MSR_RELOAD_FIXED_CTRx 
—4875 
Reload value for [A32_FIXED_CTRx (R/W) 
47:0 Value loaded into [A32_FIXED_CTRx when a PEBS record is 
generated while PEBS_EN_FIXEDx = 1 and PEBS_OUTPUT = 
01B in |A32_PEBS_ENABLE, and FIXED_CTRx is overflowed. 
63:48 Reserved. 
Register Address: 14C1H—14C6H, 5313 —5318 | MSR_RELOAD_PMCx 
Reload value for [A32_PMCx (R/W) Core 


47:0 Value loaded into [A32_PMCx when a PEBS record is generated 
while PEBS_EN_PMCx = 1 and PEBS_OUTPUT = 018B in 
IA32_PEBS_ENABLE, and PMCx is overflowed. 

63:48 Reserved. 


Table 2-49 lists the MSRs of uncore PMU for Intel processors with a CPUID Signature DisplayFamily_DisplayModel 
value of 06_97H, 06_9AH, 06_BAH, 06_B7H, or 06_BFH. 
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Table 2-49. Uncore PMU MSRs Supported by 12th and 13th Generation Intel® Core™ Processors 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 396H, 918 MSR_UNC_CBO_CONFIG 
Uncore C-Box Configuration Information (R/O) Package 
3:0 Specifies the number of C-Box units with programmable counters 

(including processor cores and processor graphics). 

63:4 Reserved. 
Register Address: 2000H, 8192 MSR_UNC_CBO_0_PERFEVTSELO 
Uncore C-Box 0, Counter O Event Select MSR Package 
Register Address: 2001H, 8193 MSR_UNC_CBO_0_PERFEVTSEL1 
Uncore C-Box 0, Counter 1 Event Select MSR Package 
Register Address: 2002H, 8194 MSR_UNC_CBO_0_PERFCTRO 
Uncore C-Box 0, Performance Counter 0 Package 
Register Address: 2003H, 8195 MSR_UNC_CBO_O_PERFCTR1 
Uncore C-Box 0, Performance Counter 1 Package 
Register Address: 2008H, 8200 MSR_UNC_CBO_1_PERFEVTSELO 
Uncore C-Box 1, Counter O Event Select MSR Package 
Register Address: 2009H, 8201 MSR_UNC_CBO_1_PERFEVTSEL1 
Uncore C-Box 1, Counter 1 Event Select MSR Package 
Register Address: 200AH, 8202 MSR_UNC_CBO_1_PERFCTRO 
Uncore C-Box 1, Performance Counter 0 Package 
Register Address: 200BH, 8203 MSR_UNC_CBO_1_PERFCTR1 
Uncore C-Box 1, Performance Counter 1 Package 
Register Address: 2010H, 8208 MSR_UNC_CBO_2_PERFEVTSELO 
Uncore C-Box 2, Counter O Event Select MSR Package 
Register Address: 2011H, 8209 MSR_UNC_CBO_2_PERFEVTSEL1 
Uncore C-Box 2, Counter 1 Event Select MSR Package 
Register Address: 2012H, 8210 MSR_UNC_CBO_2_PERFCTRO 
Uncore C-Box 2, Performance Counter 0 Package 
Register Address: 2013H, 8211 MSR_UNC_CBO_2_PERFCTR1 
Uncore C-Box 2, Performance Counter 1 Package 
Register Address: 2018H, 8216 MSR_UNC_CBO_3_PERFEVTSELO 
Uncore C-Box 3, Counter O Event Select MSR Package 
Register Address: 2019H, 8217 MSR_UNC_CBO_3_PERFEVTSEL1 
Uncore C-Box 3, Counter 1 Event Select MSR Package 
Register Address: 201AH, 8218 MSR_UNC_CBO_3_PERFCTRO 
Uncore C-Box 3, Performance Counter 0 Package 
Register Address: 201BH, 8219 MSR_UNC_CBO_3_PERFCTR1 
Uncore C-Box 3, Performance Counter 1 Package 
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Table 2-49. Uncore PMU MSRs Supported by 12th and 13th Generation Intel® Core™ Processors 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 

Register Address: 2020H, 8224 MSR_UNC_CBO_4_PERFEVTSELO 

Uncore C-Box 4, Counter O Event Select MSR Package 
Register Address: 2021H, 8225 MSR_UNC_CBO_4_ PERFEVTSEL1 

Uncore C-Box 4, Counter 1 Event Select MSR Package 
Register Address: 2022H, 8226 MSR_UNC_CBO_4_PERFCTRO 

Uncore C-Box 4, Performance Counter 0 Package 
Register Address: 2023H, 8227 MSR_UNC_CBO_4_PERFCTR1 

Uncore C-Box 4, Performance Counter 1 Package 
Register Address: 2028H, 8232 MSR_UNC_CBO_5_PERFEVTSELO 

Uncore C-Box 5, Counter 0 Event Select MSR Package 
Register Address: 2029H, 8233 MSR_UNC_CBO_5_PERFEVTSEL1 

Uncore C-Box 5, Counter 1 Event Select MSR Package 
Register Address: 202AH, 8234 MSR_UNC_CBO_5_PERFCTRO 

Uncore C-Box 5, Performance Counter 0 Package 
Register Address: 202BH, 8235 MSR_UNC_CBO_5_PERFCTR1 

Uncore C-Box 5, Performance Counter 1 Package 
Register Address: 2030H, 8240 MSR_UNC_CBO_6_PERFEVTSELO 

Uncore C-Box 6, Counter O Event Select MSR Package 
Register Address: 2031H, 8241 MSR_UNC_CBO_6_PERFEVTSEL1 

Uncore C-Box 6, Counter 1 Event Select MSR Package 
Register Address: 2032H, 8242 MSR_UNC_CBO_6_PERFCTRO 

Uncore C-Box 6, Performance Counter 0 Package 
Register Address: 2033H, 8243 MSR_UNC_CBO_6_PERFCTR1 

Uncore C-Box 6, Performance Counter 1 Package 
Register Address: 2038H, 8248 MSR_UNC_CBO_7_PERFEVTSELO 

Uncore C-Box 7, Counter O Event Select MSR Package 
Register Address: 2039H, 8249 MSR_UNC_CBO_7_PERFEVTSEL1 

Uncore C-Box 7, Counter 1 Event Select MSR Package 
Register Address: 203AH, 8250 MSR_UNC_CBO_7_PERFCTRO 

Uncore C-Box 7, Performance Counter 0 Package 
Register Address: 203BH, 8251 MSR_UNC_CBO_7_PERFCTR1 

Uncore C-Box 7, Performance Counter 1 Package 
Register Address: 2040H, 8256 MSR_UNC_CBO_8_PERFEVTSELO 

Uncore C-Box 8, Counter O Event Select MSR Package 
Register Address: 2041H, 8257 MSR_UNC_CBO_8_PERFEVTSEL1 

Uncore C-Box 8, Counter 1 Event Select MSR Package 
Register Address: 2042H, 8258 MSR_UNC_CBO_8_PERFCTRO 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Uncore C-Box 8, Performance Counter O Package 
Register Address: 2043H, 8259 MSR_UNC_CBO_8_PERFCTR1 
Uncore C-Box 8, Performance Counter 1 Package 
Register Address: 2048H, 8264 MSR_UNC_CBO_9_PERFEVTSELO 
Uncore C-Box 9, Counter O Event Select MSR Package 
Register Address: 2049H, 8265 MSR_UNC_CBO_9_PERFEVTSEL1 
Uncore C-Box 9, Counter 1 Event Select MSR Package 
Register Address: 204AH, 8266 MSR_UNC_CBO_9_PERFCTRO 
Uncore C-Box 9, Performance Counter O Package 
Register Address: 204BH, 8267 MSR_UNC_CBO_9_PERFCTR1 
Uncore C-Box 9, Performance Counter 1 Package 
Register Address: 2FDOH, 12240 MSR_UNC_ARB_O_PERFEVTSELO 
Uncore Arb Unit 0, Counter 0 Event Select MSR Package 
Register Address: 2FD1H, 12241 MSR_UNC_ARB_O_PERFEVTSEL1 
Uncore Arb Unit 0, Counter 1 Event Select MSR Package 
Register Address: 2FD2H, 12242 MSR_UNC_ARB_O_PERFCTRO 
Uncore Arb Unit 0, Performance Counter O Package 
Register Address: 2FD3H, 12243 MSR_UNC_ARB_O_PERFCTR1 
Uncore Arb Unit 0, Performance Counter 1 Package 
Register Address: 2FD4H, 12244 MSR_UNC_ARB_O_PERF_STATUS 
Uncore Arb Unit 0, Performance Status Package 
Register Address: 2FD5H, 12245 MSR_UNC_ARB_O_PERF_CTRL 
Uncore Arb Unit 0, Performance Control Package 
Register Address: 2FD8H, 12248 MSR_UNC_ARB_1_PERFEVTSELO 
Uncore Arb Unit 1, Counter O Event Select MSR Package 
Register Address: 2FD9H, 12249 MSR_UNC_ARB_1_PERFEVTSEL1 
Uncore Arb Unit 1, Counter 1 Event Select MSR Package 
Register Address: 2FDAH, 12250 MSR_UNC_ARB_1_PERFCTRO 
Uncore Arb Unit 1, Performance Counter O Package 
Register Address: 2FDBH, 12251 MSR_UNC_ARB_1_PERFCTR1 
Uncore Arb Unit 1, Performance Counter 1 Package 
Register Address: 2FDCH, 12252 MSR_UNC_ARB_1_PERF_STATUS 
Uncore Arb Unit 1, Performance Status Package 
Register Address: 2FDDH, 12253 MSR_UNC_ARB_1_PERF_CTRL 
Uncore Arb Unit 1, Performance Control Package 
Register Address: 2FDEH, 12254 MSR_UNC_PERF_FIXED_CTRL 
Uncore Fixed Counter Control (R/W) Package 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
19:0 Reserved. 
20 Enable overflow propagation. 
21 Reserved. 
22 Enable counting. 
63:23 Reserved. 
Register Address: 2FDFH, 12255 MSR_UNC_PERF_FIXED_CTR 
Uncore Fixed Counter Package 
43:0 Current count. 
63:44 Reserved. 
Register Address: 2FFOH, 12272 MSR_UNC_PERF_GLOBAL_CTRL 
Uncore PMU Global Control Package 
0 Slice O select. 
1 Slice 1 select. 
2 Slice 2 select. 
3 Slice 3 select. 
4 Slice 4 select. 
18:5 Reserved. 
29 Enable all uncore counters. 
30 Enable wake on PMI. 
31 Enable Freezing counter when overflow. 
63:32 Reserved. 
Register Address: 2FF2H, 12274 MSR_UNC_PERF_GLOBAL_STATUS 
Uncore PMU Main Status Package 
0 Fixed counter overflowed. 
1 An ARB counter overflowed. 
2 Reserved. 
3 A CBox counter overflowed (on any slice). 
63:4 Reserved. 


2.17.6 MSRs Introduced in the Intel® Xeon® Scalable Processor Family 


The Intel® Xeon® Scalable Processor Family (CPUID Signature DisplayFamily_DisplayModel value of 06_55H) 
supports the MSRs listed in Table 2-50. 


Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_55H 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 3AH, 58 


IA32_FEATURE_CONTROL 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Control Features in Intel 64 Processor (R/W) Thread 
See Table 2-2. 

0 Lock (R/WL) 

1 Enable VMX Inside SMX Operation (R/WL) 

2 Enable VMX Outside SMX Operation (R/WL) 

14:8 SENTER Local Functions Enables (R/WL) 

15 SENTER Global Functions Enable (R/WL) 

18 SGX Global Functions Enable (R/WL) 

20 LMCE_ENABLED (R/WL) 

63:21 Reserved. 

Register Address: 4EH, 78 IA32_PPIN_CTL (MSR_PPIN_CTL) 

Protected Processor Inventory Number Enable Control (R/W) Package 

0 LockOut (R/WO) 
See Table 2-2. 

1 Enable_PPIN (R/W) 
See Table 2-2. 

63:2 Reserved. 

Register Address: 4FH, 79 IA32_PPIN (MSR_PPIN) 

Protected Processor Inventory Number (R/O) Package 

63:0 Protected Processor Inventory Number (R/O) 
See Table 2-2. 

Register Address: CEH, 206 MSR_PLATFORM_INFO 

Platform Information Package 

Contains power management and other model specific features enumeration. See http://biosbits.org. 

7:0 Reserved. 

15:8 Maximum Non-Turbo Ratio (R/O) Package 
See Table 2-26. 

22:16 Reserved. 

23 PPIN_CAP (R/O) Package 
See Table 2-26. 

27:24 Reserved. 

28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
See Table 2-26. 

29 Programmable TDP Limit for Turbo Mode (R/O) Package 
See Table 2-26. 

30 Programmable T] OFFSET (R/O) Package 
See Table 2-26. 

39:31 Reserved. 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
47:40 Maximum Efficiency Ratio (R/O) Package 
See Table 2-26. 
63:48 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Core 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state parameters or 
ACPI C-states. See http://biosbits.org. 
2:0 Package C-State Limit (R/W) 
Specifies the lowest processor-specific C-state code name (consuming the 
least power) for the package. The default is set as factory-configured 
package C-state limit. 
The following C-state code name encodings are supported: 
O00b: CO/C1 (no package C-state support) 
001b: C2 
010b: C6 (non-retention) 
011b: C6 (retention) 
111b: No Package C state limits. All C states supported by the processor 
are available. 
9:3 Reserved. 
10 1/0 MWAIT Redirection Enable (R/W) 
14:11 Reserved. 
15 CFG Lock (R/WO) 
16 Automatic C-State Conversion Enable (R/W) 
If 1, the processor will convert HALT or MWAT(C1) to MWAIT(C6). 
24:17 Reserved. 
25 C3 State Auto Demotion Enable (R/W) 
26 C1 State Auto Demotion Enable (R/W) 
27 Enable C3 Undemotion (R/W) 
28 Enable C1 Undemotion (R/W) 
29 Package C State Demotion Enable (R/W) 
30 Package C State Undemotion Enable (R/W) 
63:31 Reserved. 
Register Address: 1 79H, 377 IA32_MCG_CAP 
Global Machine Check Capability (R/O) Thread 
7:0 Count. 
8 MCG_CTL_P 
9 MCG_EXT_P 
10 MCP_CMCI_P 
11 MCG_TES_P 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
15:12 Reserved. 
23:16 MCG_EXT_CNT 
24 MCG_SER_P 
25 MCG_EM_P 
26 MCG_ELOG_P 
63:27 Reserved. 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Thread 
Reports SMM capability Enhancement. Accessible only while in SMM. 
57:0 Reserved. 
58 SMM_Code_Access_Chk (SMM-RO) 
If set to 1 indicates that the SMM code access restriction is supported and 
a host-space interface is available to SMM handler. 
59 Long_Flow_Indication (SMM-RO) 
If set to 1 indicates that the SMM long flow indicator is supported and a 
host-space interface is available to SMM handler. 
63:60 Reserved. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Core 


See Table 2-2. 


0 


Thermal Status (R/O) 
See Table 2-2. 


Thermal Status Log (R/WCO) 
See Table 2-2. 


PROTCHOT # or FORCEPR# Status (R/O) 
See Table 2-2. 


PROTCHOT # or FORCEPR# Log (R/WCO) 
See Table 2-2. 


Critical Temperature Status (R/O) 
See Table 2-2. 


Critical Temperature Status Log (R/WCO) 
See Table 2-2. 


Thermal Threshold #1 Status (R/O) 
See Table 2-2. 


Thermal Threshold #1 Log (R/WCO) 
See Table 2-2. 


Thermal Threshold #2 Status (R/O) 
See Table 2-2. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
9 Thermal Threshold #2 Log (R/WCO) 
See Table 2-2. 
10 Power Limitation Status (R/O) 
See Table 2-2. 
11 Power Limitation Log (R/WCO) 
See Table 2-2. 
12 Current Limit Status (R/O) 
See Table 2-2. 
13 Current Limit Log (R/WCO) 
See Table 2-2. 
14 Cross Domain Limit Status (R/O) 
See Table 2-2. 
15 Cross Domain Limit Log (R/WCO) 
See Table 2-2. 
22:16 Digital Readout (R/O) 
See Table 2-2. 
26:23 Reserved. 
30:27 Resolution in Degrees Celsius (R/O) 
See Table 2-2. 
31 Reading Valid (R/O) 
See Table 2-2. 
63:32 Reserved. 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Package 
15:0 Reserved. 
23:16 Temperature Target (R/O) 
See Table 2-26. 
27:24 TCC Activation Offset (R/W) 
See Table 2-26. 
63:28 Reserved. 
Register Address: 1ADH, 429 MSR_TURBO_RATIO_LIMIT 
This register defines the ratio limits. RATIO[O:7] must be populated in ascending order. RATIO[i+1] must be less than | Package 
or equal to RATIO[i]. Entries with RATIO[i] will be ignored. If any of the rules above are broken, the configuration is 
silently rejected. If the programmed ratio is: 
» Above the fused ratio for that core count, it will be clipped to the fuse limits (assuming !OC). 
* Below the min supported ratio, it will be clipped. 
7:0 RATIO_O 
Defines ratio limits. 
15:8 RATIO_1 
Defines ratio limits. 


Vol.4 2-383 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
23:16 RATIO_2 
Defines ratio limits. 
31:24 RATIO_3 
Defines ratio limits. 
39:32 RATIO_4 
Defines ratio limits. 
47:40 RATIO_5 
Defines ratio limits. 
55:48 RATIO_6 
Defines ratio limits. 
63:56 RATIO_7 
Defines ratio limits. 
Register Address: 1 AEH, 430 MSR_TURBO_RATIO_LIMIT_CORES 
This register defines the active core ranges for each frequency point. NUMCORE[0:7] must be populated in ascending | Package 
order. NUMCORE[i+1] must be greater than NUMCORE{i]. Entries with NUMCORE[i] == 0 will be ignored. The last valid 
entry must have NUMCORE >= the number of cores in the SKU. If any of the rules above are broken, the configuration 
is silently rejected. 
7:0 NUMCORE_O 
Defines the active core ranges for each frequency point. 
15:8 NUMCORE_1 
Defines the active core ranges for each frequency point. 
23:16 NUMCORE_2 
Defines the active core ranges for each frequency point. 
31:24 NUMCORE_3 
Defines the active core ranges for each frequency point. 
39:32 NUMCORE_4 
Defines the active core ranges for each frequency point. 
47:40 NUMCORE_5 
Defines the active core ranges for each frequency point. 
55:48 NUMCORE_6 
Defines the active core ranges for each frequency point. 
63:56 NUMCORE_7 
Defines the active core ranges for each frequency point. 
Register Address: 280H, 640 IA32_MCO_CTL2 
See Table 2-2. Core 
Register Address: 281H, 641 IA32_MC1_CTL2 
See Table 2-2. Core 
Register Address: 282H, 642 IA32_MC2_CTL2 
See Table 2-2. Core 
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Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
Register Address: 283H, 643 IA32_MC3_CTL2 
See Table 2-2. Core 
Register Address: 284H, 644 IA32_MC4_CTL2 
See Table 2-2. Package 
Register Address: 285H, 645 IA32_MC5_CTL2 
See Table 2-2. Package 
Register Address: 286H, 646 IA32_MC6_CTL2 
See Table 2-2. Package 
Register Address: 287H, 647 IA32_MC7_CTL2 
See Table 2-2. Package 
Register Address: 288H, 648 IA32_MC8_CTL2 
See Table 2-2. Package 
Register Address: 289H, 649 IA32_MC9_CTL2 
See Table 2-2. Package 
Register Address: 28AH, 650 IA32_MC10_CTL2 
See Table 2-2. Package 
Register Address: 28BH, 651 IA32_MC11_CTL2 
See Table 2-2. Package 
Register Address: 28CH, 652 IA32_MC12_CTL2 
See Table 2-2. Package 
Register Address: 28DH, 653 IA32_MC13_CTL2 
See Table 2-2. Package 
Register Address: 28€H, 654 IA32_MC14_CTL2 
See Table 2-2. Package 
Register Address: 28FH, 655 IA32_MC15_CTL2 
See Table 2-2. Package 
Register Address: 290H, 656 IA32_MC16_CTL2 
See Table 2-2. Package 
Register Address: 291H, 657 IA32_MC17_CTL2 
See Table 2-2. Package 
Register Address: 292H, 658 IA32_MC18_CTL2 
See Table 2-2. Package 
Register Address: 293H, 659 IA32_MC19_CTL2 
See Table 2-2. Package 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MCO reports MC errors from the IFU module. 
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Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 401H, 1025 IA32_MCO_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MCO reports MC errors from the IFU module. 

Register Address: 402H, 1026 IA32_MCO_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MCO reports MC errors from the IFU module. 
Register Address: 403H, 1027 IA32_MCO_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MCO reports MC errors from the IFU module. 
Register Address: 404H, 1028 IA32_MC1_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC1 reports MC errors from the DCU module. 

Register Address: 405H, 1029 IA32_MC1_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC1 reports MC errors from the DCU module. 

Register Address: 406H, 1030 IA32_MC1_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC1 reports MC errors from the DCU module. 
Register Address: 407H, 1031 IA32_MC1_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC1 reports MC errors from the DCU module. 
Register Address: 408H, 1032 IA32_MC2_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC2 reports MC errors from the DTLB module. 

Register Address: 409H, 1033 IA32_MC2_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC2 reports MC errors from the DTLB module. 
Register Address: 40AH, 1034 IA32_MC2_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC2 reports MC errors from the DTLB module. 
Register Address: 40BH, 1035 IA32_MC2_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC2 reports MC errors from the DTLB module. 
Register Address: 40CH, 1036 IA32_MC3_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Core 
Bank MC3 reports MC errors from the MLC module. 


Register Address: 40DH, 1037 IA32_MC3_STATUS 
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Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC3 reports MC errors from the MLC module. 


“IA32_MCi_MISC MSRs.” 


Core 


Register Address: 40EH, 1038 IA32_MC3_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC3 reports MC errors from the MLC module. 


“IA32_MCi_MISC MSRs.” 


Core 


Register Address: 40FH, 1039 IA32_MC3_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC3 reports MC errors from the MLC module. 


“IA32_MCi_MISC MSRs.” 


Core 


Register Address: 410H, 1040 IA32_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC4 reports MC errors from the PCU module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 411H, 1041 IA32_MC4_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC4 reports MC errors from the PCU module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 412H, 1042 IA32_MC4_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC4 reports MC errors from the PCU module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 413H, 1043 IA32_MC4_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC4 reports MC errors from the PCU module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 414H, 1044 IA32_MC5_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC5 reports MC errors from a link interconnect module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 415H, 1045 IA32_MC5_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC5 reports MC errors from a link interconnect module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 416H, 1046 IA32_MC5_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC5 reports MC errors from a link interconnect module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 417H, 1047 IA32_MC5_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC5 reports MC errors from a link interconnect module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 418H, 1048 IA32_MC6_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC6 reports MC errors from the integrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Register Address: 419H, 1049 IA32_MC6_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, 
Bank MC6 reports MC errors from the integrated I/O module. 


“IA32_MCi_MISC MSRs.” 


Package 


Vol.4 2-387 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 41AH, 1050 


IA32_MC6_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC6 reports MC errors from the integrated I/O module. 


Package 


Register Address: 41BH, 1051 


1A32_MC6_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 
Bank MC6 reports MC errors from the integrated I/O module. 


Package 


Register Address: 41CH, 1052 


IA32_MC7_CTL 


Bank MC7 reports MC errors from the M2 


MO. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41DH, 1053 


IA32_MC7_STATUS 


Bank MC7 reports MC errors from the M2 


MO. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41€H, 1054 


IA32_MC7_ADDR 


Bank MC7 reports MC errors from the M2 


MO. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 41FH, 1055 


IA32_MC7_MISC 


Bank MC7 reports MC errors from the M2 


MO. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 420H, 1056 


IA32_MC8_CTL 


Bank MC8 reports MC errors from the M2 


M1. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 421H, 1057 


IA32_MC8_STATUS 


Bank MC8 reports MC errors from the M2 


M1. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 422H, 1058 


IA32_MC8_ADDR 


Bank MC8 reports MC errors from the M2 


M1. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 423H, 1059 


IA32_MC8_MISC 


Bank MC8 reports MC errors from the M2 


M1. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 424H, 1060 


IA32_MC9_CTL 


Banks MC9 - MC11 report MC errors from 


the CHA. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 


Register Address: 425H, 1061 


IA32_MC9_STATUS 


Banks MC9 - MC11 report MC errors from 


the CHA. 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs," through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Package 
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Register Address: 426H, 1062 IA32_MC9_ADDR 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 427H, 1063 IA32_MC9_MISC 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 428H, 1064 IA32_MC10_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 429H, 1065 IA32_MC10_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42AH, 1066 IA32_MC10_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42BH, 1067 IA32_MC10_MISC 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42CH, 1068 IA32_MC11_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42DH, 1069 IA32_MC11_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42EH, 1070 IA32_MC11_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 42FH, 1071 IA32_MC11_MISC 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC9 - MC11 report MC errors from the CHA. 

Register Address: 430H, 1072 IA32_MC12_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC12 report MC errors from each channel of a link interconnect module. 

Register Address: 431H, 1073 IA32_MC12_STATUS 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC12 report MC errors from each channel of a link interconnect module. 

Register Address: 432H, 1074 IA32_MC12_ADDR 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC12 report MC errors from each channel of a link interconnect module. 
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Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description Scope 
Register Address: 433H, 1075 IA32_MC12_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC12 report MC errors from each channel of a link interconnect module. 
Register Address: 434H, 1076 IA32_MC13_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 435H, 1077 IA32_MC13_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 436H, 1078 IA32_MC13_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 437H, 1079 IA32_MC13_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 438H, 1080 IA32_MC14_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 439H, 1081 IA32_MC14_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 43AH, 1082 IA32_MC14_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 43BH, 1083 IA32_MC14_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 43CH, 1084 IA32_MC15_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 43DH, 1085 IA32_MC15_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 
Register Address: 43EH, 1086 IA32_MC15_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Register Address: 43FH, 1087 IA32_MC15_MISC 
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MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal 


Register Name (Former Register Name) 


Register Information / Bit Fields Bit Description 


Scope 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 440H, 1088 IA32_MC16_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 441H, 1089 IA32_MC16_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 442H, 1090 IA32_MC16_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 443H, 1091 IA32_MC16_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 444H, 1092 IA32_MC17_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 445H, 1093 IA32_MC17_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 446H, 1094 IA32_MC17_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 447H, 1095 IA32_MC17_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 448H, 1096 IA32_MC18_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 449H, 1097 IA32_MC18_STATUS 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 44AH, 1098 IA32_MC18_ADDR 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 


Register Address: 44BH, 1099 IA32_MC18_MISC 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


Banks MC13 through MC 18 report MC errors from the integrated memory controllers. 


Package 
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Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_55H (Contd.) 
Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: 44CH, 1100 IA32_MC19_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from a link interconnect module. 
Register Address: 44DH, 1101 IA32_MC19_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, "IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from a link interconnect module. 
Register Address: 44EH, 1102 IA32_MC19_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from a link interconnect module. 
Register Address: 44FH, 1103 IA32_MC19_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC19 reports MC errors from a link interconnect module. 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers Used in RAPL Interfaces (R/O) Package 
3:0 Power Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
7:4 Reserved. Package 
12:8 Energy Status Units Package 
Energy related information (in Joules) is based on the multiplier, 1/2*ESU; 
where ESU is an unsigned integer represented by bits 12:8. Default value 
is OEH (or 61 micro-joules). 
15:13 Reserved. Package 
19:16 Time Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
63:20 Reserved. 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 
DRAM RAPL Power Limit Control (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
Energy consumed by DRAM devices. 
31:0 Energy in 15.3 micro-joules. Requires BIOS configuration to enable DRAM 
RAPL mode 0 (Direct VR). 
63:32 Reserved. 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 


See Section 15.10.5, “DRAM RAPL Domain.” 


Register Address: 61CH, 1564 


MSR_DRAM_POWER_INFO 
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Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 

Register Information / Bit Fields Bit Description Scope 
DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 

Register Address: 620H, 1568 MSR_UNCORE_RATIO_LIMIT 
Uncore Ratio Limit (R/W) Package 
Out of reset, the min_ratio and max_ratio fields represent the widest possible range of uncore frequencies. Writing to 
these fields allows software to control the minimum and the maximum frequency that hardware will select. 
63:15 Reserved. 
14:8 MIN_RATIO 
Writing to this field controls the minimum possible ratio of the LLC/Ring. 
Reserved. 
6:0 MAX_RATIO 
This field is used to limit the max ratio of the LLC/Ring. 
Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 
Reserved (R/O) Package 
Reads return 0. 
Register Address: C8DH, 3213 IA32_QM_EVTSEL 
Monitoring Event Select Register (R/W) Thread 
If CPUID.(EAX=07H, ECX=0):€BX.RDT-M[bit 12] = 1. 
7:0 EventID (R/W) 
Event encoding: 
0x00: No monitoring. 
0x01: L3 occupancy monitoring. 
OxO2: Total memory bandwidth monitoring. 
0x03: Local memory bandwidth monitoring. 
All other encoding reserved. 
31:8 Reserved. 
41:32 RMID (R/W) 
63:42 Reserved. 
Register Address: C8FH, 3215 IA32_PQR_ASSOC 
Resource Association Register (R/W) Thread 
9:0 RMID 
31:10 Reserved. 
51:32 COS (R/W) 
63:52 Reserved. 
Register Address: CSOH, 3216 IA32_L3_QO0S_MASK_0O 
L3 Class Of Service Mask - COS 0 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=0. 
0:19 CBM: Bit vector of available L3 ways for COS O enforcement. 
63:20 Reserved. 
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Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
Register Address: C91H, 3217 IA32_L3_QO0S_MASK_1 
L3 Class Of Service Mask - COS 1 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=1. 
0:19 CBM: Bit vector of available L3 ways for COS 1 enforcement. 
63:20 Reserved. 
Register Address: C92H, 3218 IA32_L3_QO0S_MASK_2 
L3 Class Of Service Mask - COS 2 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=2. 
0:19 CBM: Bit vector of available L3 ways for COS 2 enforcement. 
63:20 Reserved. 
Register Address: C93H, 3219 IA32_L3_QO0S_MASK_3 
L3 Class Of Service Mask - COS 3 (R/W). Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=3. 
0:19 CBM: Bit vector of available L3 ways for COS 3 enforcement. 
63:20 Reserved. 
Register Address: C94H, 3220 IA32_L3_QO0S_MASK_4 
L3 Class Of Service Mask - COS 4 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=4. 
0:19 CBM: Bit vector of available L3 ways for COS 4 enforcement. 
63:20 Reserved. 
Register Address: C95H, 3221 IA32_L3_QO0S_MASK_5 
L3 Class Of Service Mask - COS 5 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=5. 
0:19 CBM: Bit vector of available L3 ways for COS 5 enforcement. 
63:20 Reserved. 
Register Address: C96H, 3222 IA32_L3_QO0S_MASK_6 
L3 Class Of Service Mask - COS 6 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=6. 
0:19 CBM: Bit vector of available L3 ways for COS 6 enforcement. 
63:20 Reserved. 
Register Address: C97H, 3223 IA32_L3_QOS_MASK_7 
L3 Class Of Service Mask - COS 7 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=7. 
0:19 CBM: Bit vector of available L3 ways for COS 7 enforcement. 
63:20 Reserved. 
Register Address: C98H, 3224 IA32_L3_QOS_MASK_8 
L3 Class Of Service Mask - COS 8 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=8. 
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Table 2-50. MSRs Supported by the Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_55H (Contd.) 


Register Address: Hex, Decimal Register Name (Former Register Name) 
Register Information / Bit Fields Bit Description Scope 
0:19 CBM: Bit vector of available L3 ways for COS 8 enforcement. 
63:20 Reserved. 
Register Address: C9SH, 3225 IA32_L3_QO0S_MASK_9 
L3 Class Of Service Mask - COS 9 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=9. 
0:19 CBM: Bit vector of available L3 ways for COS 9 enforcement. 
63:20 Reserved. 
Register Address: C9AH, 3226 IA32_L3_QO0S_MASK_10 
L3 Class Of Service Mask - COS 10 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=10. 
0:19 CBM: Bit vector of available L3 ways for COS 10 enforcement. 
63:20 Reserved. 
Register Address: COBH, 3227 IA32_L3_QO0S_MASK_11 
L3 Class Of Service Mask - COS 11 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=11. 
0:19 CBM: Bit vector of available L3 ways for COS 11 enforcement. 
63:20 Reserved. 
Register Address: CSCH, 3228 IA32_L3_QO0S_MASK_12 
L3 Class Of Service Mask - COS 12 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=12. 
0:19 CBM: Bit vector of available L3 ways for COS 12 enforcement. 
63:20 Reserved. 
Register Address: CSDH, 3229 IA32_L3_QOS_MASK_13 
L3 Class Of Service Mask - COS 13 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=13. 
0:19 CBM: Bit vector of available L3 ways for COS 13 enforcement. 
63:20 Reserved. 
Register Address: C9EH, 3230 IA32_L3_QO0S_MASK_14 
L3 Class Of Service Mask - COS 14 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=14. 
0:19 CBM: Bit vector of available L3 ways for COS 14 enforcement. 
63:20 Reserved. 
Register Address: C9FH, 3231 IA32_L3_QOS_MASK_15 
L3 Class Of Service Mask - COS 15 (R/W) Package 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] >=15. 
0:19 CBM: Bit vector of available L3 ways for COS 15 enforcement. 
63:20 Reserved. 
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2.17.7. MSRs Specific to the 3rd Generation Intel® Xeon® Scalable Processor Family Based on 
Ice Lake Microarchitecture 


The 3rd generation Intel® Xeon® Scalable Processor Family based on Ice Lake microarchitecture (CPUID Signature 
DisplayFamily_DisplayModel value of 06_6AH or 06_6CH) support the MSRs listed in Table 2-51. 


Table 2-51. MSRs Supported by the 3rd Generation Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of O06_6AH or 06_6CH 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 612H, 1554 MSR_PACKAGE_ENERGY_TIME_STATUS 
Package energy consumed by the entire CPU (R/W) Package 
31:0 Total amount of energy consumed since last reset. 
63:32 Total time elapsed when the energy was last updated. This is a monotonic 
increment counter with auto wrap back to zero after overflow. Unit is 
10ns. 
Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 


Allows software to set power limits for the DRAM domain and measurement attributes associated with each limit. Package 


14:0 DRAM_PP_PWR_LIM: 


Power Limit[0] for DDR domain. Units = Watts, Format = 11.3, Resolution = 
0.125W, Range = 0-2047.875W. 


15 PWR_LIM_CTRL_EN: 
Power Limit[0] enable bit for DDR domain. 


16 Reserved. 
23:17 CTRL_TIME_WIN: 
Power Limit[O] time window Y value, for DDR domain. Actual time_window 
for RAPL is: 
(1/1024 seconds) * (1+(x/4)) * (2“y) 
62:24 Reserved. 
63 PP_PWR_LIM_LOCK: 
When set, this entire register becomes read-only. This bit will typically be 
set by BIOS during boot. 
Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 
DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
31:0 Energy in 15.3 micro-joules. Requires BIOS configuration to enable DRAM 
RAPL mode 0 (Direct VR). 
63:32 Reserved. 
Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 
DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain.” 
Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 
DRAM Power Parameters (R/W) Package 
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Table 2-51. MSRs Supported by the 3rd Generation Intel® Xeon® Scalable Processor Family with a CPUID Signature 
DisplayFamily_DisplayModel Value of O6_6AH or 06_6CH (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


14:0 


Spec DRAM Power (DRAM_TDP): 

The Spec power allowed for DRAM. The TDP setting is 
typical (not guaranteed). 

The units for this value are defined in 
MSR_DRAM_POWER_INFO_UNIT[PWR_UNIT]. 


15 


Reserved. 


30:16 


Minimal DRAM Power (DRAM_MIN_PWR): 

The minimal power setting allowed for DRAM. Lower 
values will be clamped to this value. The minimum 
setting is typical (not guaranteed). 

The units for this value are defined in 
MSR_DRAM_POWER_INFO_UNIT[PWR_UNIT]. 


31 


Reserved. 


46:32 


Maximal Package Power (DRAM_MAX_PWR): 

The maximal power setting allowed for DRAM. Higher 
values will be clamped to this value. The maximum 
setting is typical (not guaranteed). 

The units for this value are defined in 
MSR_DRAM_POWER_INFO_UNIT[PWR_UNIT]. 


47 


Reserved. 


54:48 


Maximal Time Window (DRAM_MAX_WIN): 

The maximal time window allowed for the DRAM. 
Higher values will be clamped to this value. 

x = PKG_MAX_WIN[54:53] 

y = PKG_MAX_WIN[52:48] 


The timing interval window is a floating-point number given by 1.x 


*power(2,y). 


The unit of measurement is defined in 
MSR_DRAM_POWER_INFO_UNIT[TIME_UNIT]. 


62:55 


Reserved. 


63 


LOCK: 
Lock bit to lock the register. 


Register Address: 981H, 2433 


IA32_TME_CAPABILITY 


See Table 2-2. 


Register Address: 982H, 2434 


IA32_TME_ACTIVATE 


See Table 2-2. 


Register Address: 983H, 2435 
See Table 2-2. 


IA32_TME_EXCLUDE_MASK 


Register Address: 984H, 2436 


IA32_TME_EXCLUDE_BASE 


See Table 2-2. 


Vol.4 2-397 


MODEL-SPECIFIC REGISTERS (MSRS) 


2.17.8 |MSRs Specific to the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 


The 4th generation Intel® Xeon® Scalable Processor Family based on Sapphire Rapids microarchitecture (CPUID 
Signature DisplayFamily_DisplayModel value of 06_8FH) and the 5th generation Intel® Xeon® Scalable Processor 
Family based on Emerald Rapids microarchitecture (CPUID Signature DisplayFamily_DisplayModel value of 
06_CFH) both support the MSRs listed in Section 2.17, “MSRs In the 6th—13th Generation Intel® Core™ Proces- 
sors, 1st—5th Generation Intel® Xeon® Scalable Processor Families, Intel® Core™ Ultra 7 Processors, 8th Gener- 
ation Intel® Core™ i3 Processors, and Intel® Xeon® E Processors,” including Table 2-52. For an MSR listed in Table 
2-52 that also appears in the model-specific tables of prior generations, Table 2-52 supersedes prior generation 
tables. 


Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of 06_8FH and 06_CFH) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Register Address: 33H, 51 MSR_MEMORY_CTRL 
Memory Control Register (R/W) Core 
27:0 Reserved. 
28 UC_LOCK_DISABLE 


If set to 1, a UC lock will cause a #GP(0) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 
29 SPLIT_LOCK_DISABLE 

If set to 1, a split lock will cause an #AC(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 


31:30 Reserved. 

Register Address: A7H, 167 MSR_BIOS_DEBUG 

BIOS DEBUG (R/O) Thread 
See Table 2-45. 

Register Address: BCH, 188 IA32_MISC_PACKAGE_CTLS 

Power Filtering Control (R/W) Package 
IA32_ARCH_CAPABILITIES[bit 10] enumerates support for this MSR. 

See Table 2-2. 

Register Address: CFH, 207 IA32_CORE_CAPABILITIES 

IA32 Core Capabilities Register (R/W) Core 


If CPUID.(EAX=07H, ECX=0):EDX[30] = 1. 
This MSR provides an architectural enumeration function for model-specific behavior. 


0 Reserved: returns zero. 
1 Reserved: returns zero. 
2 INTEGRITY_CAPABILITIES 
When set to 1, the processor supports MSR_INTEGRITY_CAPABILITIES. 
3 RSM_IN_CPLO_ONLY 


Indicates that RSM will only be allowed in CPLO and will #GP for all non- 
CPLO privilege levels. 
4 UC_LOCK_DISABLE_SUPPORTED 


When read as 1, software can set bit 28 of MSR_MEMORY_CTRL (MSR 
address 33H). 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
5 SPLIT_LOCK_DISABLE_SUPPORTED 
When read as 1, software can set bit 29 of MSR_MEMORY_CTRL. 
6 Reserved: returns zero. 
UC_STORE_THROTTLING_SUPPORTED 
Indicates that the snoop filter quality of service MSRs are supported on 
this core. This is based on the existence of a non-inclusive cache and the 
L2/MLC QoS feature supported. 
63:8 Reserved: returns zero. 
Register Address: 1H, 225 IA32_UMWAIT_CONTROL 
UMWAIT Control (R/W) 
See Table 2-2. 
Register Address: EDH, 237 MSR_RAR_CONTROL 
RAR Control (R/W) Thread 
63:32 Reserved. 
31 ENABLE 
RAR events are recognized. When RAR is not enabled, RARs are dropped. 
30 IGNORE_IF 
Allow RAR servicing at the RLP regardless of the value of RFLAGS.IF. 
29:0 Reserved. 
Register Address: EEH, 238 MSR_RAR_ACTION_VECTOR_BASE 
Pointer to RAR Action Vector (R/W) Thread 
63:MAXPHYADDR Reserved. 
MAXPHYADDR- 1:6 VECTOR_PHYSICAL_ADDRESS 
Pointer to the physical address of the 64B aligned RAR action vector. 
5:0 Reserved. 
Register Address: EFH, 239 MSR_RAR_PAYLOAD_TABLE_BASE 
Pointer to Base of RAR Payload Table (R/W) Thread 
63:MAXPHYADDR Reserved. 
MAXPHYADDR-1:12 TABLE_PHYSICAL_ADDRESS 
Pointer to the base physical address of the 4K aligned RAR payload table. 
11:0 Reserved. 
Register Address: FOH, 240 MSR_RAR_INFO 
Read Only RAR Information (RO) Thread 
63:38 Always zero. 
37:32 Table Max Index 
Maximum supported payload table index. 
31:0 Supported payload type bitmap. A value of 1 in bit position [i] indicates 


that payload type [i] is supported. 


Register Address: 105H, 261 


MSR_CORE_BIST 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O06_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


Core BIST (R/W) 
Controls Array BIST activation and status ch 


ecking as part of FUSA. 


Core 


31:0 


BIST_ARRAY 
Bitmap indicating which arrays to run BIST on (WRITE). 


Bitmap indicating which arrays were not processed, i.e., completion mask 
(READ). 


39:32 


BANK 


Array bank of the [least significant set bit] array indicated in EAX to start 
BIST(WRITE). 


Array bank interrupted or failed (READ). 


47:40 


62:48 


DWORD 


Array dword of the [least significant set bit] array indicated in EAX to 
start BIST (WRITE). 


Array dword interrupted or failed (READ). 


Reserved. 


63 


CTRL_RESULT 


Indicates whether WRMSR should signal Machine-Check upon BIST-error 
(WRITE). 


BIST result PASS(0)/FAIL(1) of the (least significant set bit) array 
indicated in EAX (READ). 


Register Address: 10AH, 266 


IA32_ARCH_CAPABILITIES 


Enumeration of Architectural Features (R/O) 


See Table 2-2. 


Register Address: 1A4H, 420 
Prefetch Disable Bits (R/W) 


MSR_PREFETCH_CONTROL 


0 


L2_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L2 hardware prefetcher, which fetches additional lines of 
code or data into the L2 cache. 


L2_ADJACENT_CACHE_LINE_PREFETCHER_DISABLE 


If 1, disables the adjacent cache line prefetcher, which fetches the cache 
line that comprises a cache line pair (128 bytes). 


DCU_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L1 data cache prefetcher, which fetches the next cache 
line into L1 data cache. 


DCU_IP_PREFETCHER_DISABLE 

If 1, disables the L1 data cache IP prefetcher, which uses sequential load 
history (based on instruction pointer of previous loads) to determine 
whether to prefetch additional lines. 


Reserved. 


AMP_PREFETCH_DISABLE 
If 1, disables the L2 Adaptive Multipath Probability (AMP) prefetcher. 


63:6 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 1ADH, 429 MSR_PRIMARY_TURBO_RATIO_LIMIT 
Primary Maximum Turbo Ratio Limit (R/W) Package 
See Table 2-46. 
Register Address: 1AEH, 430 MSR_TURBO_RATIO_LIMIT_CORES 
See Table 2-50. Package 
Register Address: 1C4H, 452 IA32_XFD 
Extended Feature Detect (R/W) 
See Table 2-2. 
Register Address: 1C5H, 453 IA32_XFD_ERR 
XFD Error Code (R/W) 
See Table 2-2. 
Register Address: 2C2H, 706 MSR_COPY_SCAN_HASHES 
COPY_SCAN_HASHES (Ww) Die 
63:0 SCAN_HASH_ADDR 
Contains the linear address of the SCAN Test HASH Binary loaded into 
memory. 
Register Address: 2C3H, 707 MSR_SCAN_HASHES_STATUS 
SCAN_HASHES_STATUS (R/O) 
15:0 CHUNK_SIZE Die 
Chunk size of the test in KB. 
23:16 NUM_CHUNKS Die 
Total number of chunks. 
31:24 Reserved: all zeros. 
39:32 ERROR_CODE Thread 


The error-code refers to the LP that runs WRMSR(2C2H). 

Ox0O: No error reported. 

0x1: Attempt to copy scan-hashes when copy already in progress. 
Ox2: Secure Memory not set up correctly. 

0x3: Scan-image header Image_info.ProgramlD doesn’t match 
RDMSR(2D9H)[3 1:24], or scan-image header Processor-Signature doesn't 
match F/M/S, or scan-image header Processor-Flags doesn't match 
PlatformID. 

Ox4: Reserved 

Ox5: Integrity check failed. 

Ox6: Re-install of scan test image attempted when current scan test 
image is in use by other LPs. 


50:40 Reserved: set to all zeros. 

62:51 MAX_CORE_LIMIT Die 
Maximum Number of cores that can run Intel® In-field Scan simultaneously 
minus 1. 


O means 1 core ata time. 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O06_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
63 Valid Die 
Valid bit is set when COPY_SCAN_HASHES has completed successfully. 
Register Address: 2C4H, 708 MSR_AUTHENTICATE_AND_COPY_CHUNK 
AUTHENTICATE_AND_COPY_CHUNK (W) Die 
7:0 CHUNK_INDEX 


Chunk Index, should be less than the total number of chunks defined by 
NUM_CHUNKS (MSR_SCAN_HASHES_STATUS[23:16)]). 


63:8 CHUNK_ADDR 
Bits 63:8 of 256B aligned Linear address of scan chunk in memory. 

Register Address: 2C5H, 709 MSR_CHUNKS_AUTHENTICATION_STATUS 

CHUNKS_AUTHENTICATION_STATUS (R/O) 

7:0 VALID_CHUNKS Die 
Total number of Valid (authenticated) chunks. 

15:8 TOTAL_CHUNKS Die 
Total number of chunks. 

31:16 Reserved: all zeros. 

39:32 ERROR_CODE Thread 


The error code refers to the LP that runs WRMSR(2C4H). 
OxO: No error reported. 


0x1: Attempt to authenticate a CHUNK which is already marked as 
authentic or is currently being installed by another core. 


Ox2: CHUNK authentication error. HASH of chunk did not match expected 


value. 
63:40 Reserved: set to all zeros. 
Register Address: 2C6H, 710 MSR_ACTIVATE_SCAN 
ACTIVATE_SCAN (Ww) Thread 
7:0 CHUNK_START_INDEX 

Indicates chunk index to start from. 
15:8 CHUNK_STOP_INDEX 

Indicates what chunk index to stop at (inclusive). 
31:16 Reserved: all zeros. 
62:32 THREAD_WAIT_DELAY 

TSC based delay to allow threads to rendezvous. 
63 SIGNAL_MCE 


If 1, then on scan-error log MC in MC4_STATUS and signal MCE if machine 
check signaling enabled in MC4_CTL[O}. 


If 0, then no logging/no signaling. 
Register Address: 2C7H, 711 MSR_SCAN_STATUS 


SCAN_STATUS (R/O) 


2-402 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


7:0 


CHUNK_NUM 
SCAN Chunk that was reached. 


Core 


CHUNK_STOP_INDEX 


Indicates what chunk index to stop at (inclusive). Maps to same field in 
WRMSR(ACTIVATE_SCAN). 


Core 


Reserved: return all zeros. 


ERROR_CODE 
Ox0O: No error. 
Ox1: SCAN operation did not start. Other thread did not join in time. 


Ox2: SCAN operation did not start. Interrupt occurred prior to threads 
rendezvous. 


Ox3: SCAN operation did not start. Power Management conditions are 
inadequate to run Intel In-field Scan. 

Ox4: SCAN operation did not start. Non-valid chunks in the range 
CHUNK_STOP_INDEX : CHUNK_START_INDEX. 

Ox5: SCAN operation did not start. Mismatch in arguments between 
threads TO/T1. 

Ox6: SCAN operation did not start. Core not capable of performing SCAN 
currently. 

Ox8: SCAN operation did not start. Exceeded number of Logical 
Processors (LP) allowed to run Intel In-field Scan concurrently. 
MAX_CORE_LIMIT exceeded. 

Ox9: Interrupt occurred. Scan operation aborted prematurely, not all 
chunks requested have been executed. 


Thread 


61:40 
62 


63 


Reserved: return all zeros. 

SCAN_CONTROL_ERROR 

Scan-System-Controller malfunction. 
SCAN_SIGNATURE_ERROR 

Core failed SCAN-SIGNATURE checking for this chunk. 


Core 


Core 


Register Address: 2C8H, 712 


MSR_SCAN_MODULE_ID 


SCAN_MODULE_ID (R/O) 


Module 


31:0 


ReviD of the currently installed scan test image. Maps to Revision field in 
external header (offset 4). 


63:32 


Reserved: return all zeros. 


Register Address: 2CSH, 713 


MSR_LAST_SAF_WP 


LAST_SAF_WP (R/O) 


Core 


31:0 


LAST_WP 


Provides information about the core when the last 
WRMSR(ACTIVATE_SCAN) was executed. Available only if enumerated in 
MSR_INTEGRITY_CAPABILITIES[1 0:9}. 


63:32 
Register Address: 2DSH, 729 


Reserved: return all zeros. 
MSR_INTEGRITY_CAPABILITIES 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 


(CPUID Signature DisplayFamily_DisplayModel Values of 06_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


31:0 
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TOTAL_ENERGY_CONSUMED 
Total energy consumption in J (32.0), in 10nsec units. 


Register Information / Bit Fields Bit Description Scope 
INTEGRITY_CAPABILITIES (R/O) Module 
0 STARTUP_SCAN_BIST 
When set, supports Intel In-field Scan. 
3:1 Reserved: return all zeros. 
4 PERIODIC_SCAN_BIST 
When set, supports Intel In-field Scan. 
23:5 Reserved: return all zeros. 
31:24 ID of the scan programs supported for this part. WRMSR(2C2H) verifies 
this value against the corresponding value in the scan-image header, ie., 
Image_info. 
Register Address: 410H, 1040 IA32_MC4_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC4 reports MC errors from the PCU module. 
If SIGNAL_MCE is set, a Scan Status is logged in MC4_STATUS and MC4_MISC. 
Register Address: 411H, 1041 IA32_MC4_STATUS 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC4 reports MC errors from the PCU module. 
If SIGNAL_MCE is set, a Scan Status is logged in MC4_STATUS and MC4_MISC. 
Register Address: 412H, 1042 IA32_MC4_ADDR 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC4 reports MC errors from the PCU module. 
If SIGNAL_MCE is set, a Scan Status is logged in MC4_STATUS and MC4_MISC. 
Register Address: 413H, 1043 IA32_MC4_MISC 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs,” through Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Package 
Bank MC4 reports MC errors from the PCU module. 
If SIGNAL_MCE is set, a Scan Status is logged in MC4_STATUS and MC4_MISC. 
Register Address: 492H, 1170 IA32_VMX_PROCBASED_CTLS3 
Capability Reporting Register of Tertiary Processor-Based VM-Execution Controls (R/O) 
See Table 2-2. 
Register Address: 493H, 1171 IA32_VMX_EXIT_CTLS2 
Capability Reporting Register of Secondary VM-Exit Controls (R/O) 
See Table 2-2. 
Register Address: 540H, 1344 MSR_THREAD_UARCH_CTL 
Thread Microarchitectural Control (R/W) Thread 
See Table 2-47. 
Register Address: 64DH, 1613 MSR_PLATFORM_ENERGY_STATUS 
Platform Energy Status (R/O) Package 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
63:32 TIME_STAMP 
Time stamp (U32.0). 
Register Address: 65CH, 1628 MSR_PLATFORM_POWER_LIMIT 
Platform Power Limit Control (R/W-L) Package 


16:0 


POWER_LIMIT_1 


The average power limit value that the platform must not exceed over a 
time window as specified by the Power_Limit_1_TIME field. 

The default value is the Thermal Design Power (TDP) and varies with 
product skus. The unit is specified in MSR_RAPL_POWER_UNIT. 


POWER_LIMIT_1_EN 


When set, the processor can apply control policies such that the platform 
average power does not exceed the Power_Limit_1 value over an 
exponential weighted moving average of the time window. 


CRITICAL_POWER_CLAMP_1 


When set, the processor can go below the OS-requested P States to 
maintain the power below the specified Power_Limit_1 value. 


25:19 


POWER_LIMIT_1_TIME 


This indicates the time window over which the Power_Limit_1 value 
should be maintained. 


This field is made up of two numbers from the following equation: 
Time Window = (float) ((1+(X/4))*(2*Y)), where: 

X = POWER_LIMIT_1_TIME[23:22] 

Y = POWER_LIMIT_1_TIME[21:17] 


The maximum allowed value in this field is defined in 
MSR_PKG_POWER_INFO[PKG_MAX_WIN]. 


The default value is ODH, and the unit is specified in 
MSR_RAPL_POWER_UNIT[Time Unit]. 


31:26 


Reserved. 


48:32 


POWER_LIMIT_2 


This is the Duration Power limit value that the platform must not exceed. 


The unit is specified in MSR_RAPL_POWER_UNIT. 


49 


Enable Platform Power Limit #2 


When set, enables the processor to apply control policy such that the 
platform power does not exceed Platform Power limit #2 over the Short 
Duration time window. 


50 


57:51 


Platform Clamping Limitation #2 

When set, allows the processor to go below the OS requested P states in 
order to maintain the power below specified Platform Power Limit #2 
value. 

POWER_LIMIT_2_TIME 

This indicates the time window over which the Power_Limit_2 value 
should be maintained. 


This field has the same format as the POWER_LIMIT_1_TIME field. 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 


(CPUID Signature DisplayFamily_DisplayModel Values of O06_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
62:58 Reserved. 
63 LOCK 
Setting this bit will lock all other bits of this MSR until system RESET. 
Register Address: 665H, 1637 MSR_PLATFORM_POWER_INFO 
Platform Power Information (R/W) Package 
16:0 MAX_PPL1 
Maximum PP L1 value. 
The unit is specified in MSR_RAPL_POWER_UNIT. 
31:17 MIN_PPL1 
Minimum PP L1 value. 
The unit is specified in MSR_RAPL_POWER_UNIT. 
48:32 MAX_PPL2 
Maximum PP L2 value. 
The unit is specified in MSR_RAPL_POWER_UNIT. 
55:49 MAX_TW 
Maximum time window. 
The unit is specified in MSR_RAPL_POWER_UNIT. 
62:56 Reserved. 
63 LOCK 
Setting this bit will lock all other bits of this MSR until system RESET. 
Register Address: 666H, 1638 MSR_PLATFORM_RAPL_SOCKET_PERF_STATUS 
Platform RAPL Socket Performance Status (R/O) Package 


31:0 


Count of limited performance due to platform RAPL limit. 


Register Address: 6AOH, 1696 


IA32_U_CET 


Configure User Mode CET (R/W) 
See Table 2-2. 


Register Address: 6A2H, 1698 IA32_S_CET 
Configure Supervisor Mode CET (R/W) 

See Table 2-2. 

Register Address: 6A4H, 1700 IA32_PLO_SSP 


See Table 2-2. 


Linear address to be loaded into SSP on transition to privilege level 0. (R/W) 


Register Address: 6A5H, 1701 


IA32_PL1_SSP 


See Table 2-2. 
Register Address: 6A6H, 1702 


Linear address to be loaded into SSP on transition to privilege level 1. (R/W) 


IA32_PL2_SSP 


See Table 2-2. 


Linear address to be loaded into SSP on transition to privilege level 2. (R/W) 


Register Address: 6A7H, 1703 


IA32_PL3_SSP 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Linear address to be loaded into SSP on transition to privilege level 3. (R/W) 
See Table 2-2. 
Register Address: 6A8H, 1704 IA32_INTERRUPT_SSP_TABLE_ADDR 


Linear address of a table of seven shadow stack pointers that are selected in IA-32e mode using the IST index (when 
not O) from the interrupt gate descriptor. (R/W) 


See Table 2-2. 
Register Address: 6€1H, 1761 IA32_PKRS 


Specifies the PK permissions associated with each protection domain for supervisor pages (R/W) 
See Table 2-2. 


Register Address: 776H, 1910 IA32_HWP_CTL 
See Table 2-2. 
Register Address: 981H, 2433 IA32_TME_CAPABILITY 


Memory Encryption Capability MSR 
See Table 2-2. 


Register Address: 985H, 2437 IA32_UINTR_RR 


User Interrupt Request Register (R/W) 
See Table 2-2. 


Register Address: 986H, 2438 IA32_UINTR_HANDLER 


User Interrupt Handler Address (R/W) 
See Table 2-2. 


Register Address: 987H, 2439 IA32_UINTR_STACKADJUST 


User Interrupt Stack Adjustment (R/W) 
See Table 2-2. 


Register Address: 988H, 2440 IA32_UINTR_MISC 


User-Interrupt Target-Table Size and Notification Vector (R/W) 
See Table 2-2. 


Register Address: 989H, 2441 IA32_UINTR_PD 


User Interrupt PID Address (R/W) 
See Table 2-2. 


Register Address: 98AH, 2442 IA32_UINTR_TT 


User-Interrupt Target Table (R/W) 
See Table 2-2. 


Register Address: C70H, 3184 MSR_B1_PMON_EVNT_SELO 
Uncore B-box 1 perfmon event select MSR. Package 
Register Address: C71H, 3185 MSR_B1_PMON_CTRO 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C72H, 3186 MSR_B1_PMON_EVNT_SEL1 


Uncore B-box 1 perfmon event select MSR. Package 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 
(CPUID Signature DisplayFamily_DisplayModel Values of 06_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: C73H, 3187 MSR_B1_PMON_CTR1 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C74H, 3188 MSR_B1_PMON_EVNT_SEL2 
Uncore B-box 1 perfmon event select MSR. Package 
Register Address: C75H, 3189 MSR_B1_PMON_CTR2 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C76H, 3190 MSR_B1_PMON_EVNT_SEL3 
Uncore B-box 1vperfmon event select MSR. Package 
Register Address: C77H, 3191 MSR_B1_PMON_CTR3 
Uncore B-box 1 perfmon counter MSR. Package 
Register Address: C82H, 3122 MSR_W_PMON_BOX_OVF_CTRL 
Uncore W-box perfmon local box overflow control MSR. Package 
Register Address: C8FH, 3215 IA32_PQR_ASSOC 
See Table 2-2. 
Register Address: CQOH—C9EH, 3216— IA32_L3_QOS_MASK_0 through IA32_L3_QOS_MASK_14 
3230 
See Table 2-50. Package 
Register Address: DIOH—D17H, 3344— IA32_L2_QOS_MASK_[0-7] 
3351 
IA32_CR_L2_QOS_MASK_[0-7] Core 
If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] = 0. See Table 2-2. 
Register Address: D93H, 3475 IA32_PASID 
See Table 2-2. 
Register Address: 1200H—121FH, 4608— | IA32_LBR_x_INFO 
4639 
Last Branch Record Entry X Info Register (R/W) 
See Table 2-2. 
Register Address: 1406H, 5126 1A32_MCU_CONTROL 
See Table 2-2. 
Register Address: 14CEH, 5326 IA32_LBR_CTL 
Last Branch Record Enabling and Configuration Register (R/W) 
See Table 2-2. 
Register Address: 14CFH, 5327 IA32_LBR_DEPTH 
Last Branch Record Maximum Stack Depth Register (R/W) 
See Table 2-2. 
Register Address: 1500H—151FH, 5376— | IA32_LBR_x_FROM_IP 
5407 
Last Branch Record Entry X Source IP Register (R/W) 
See Table 2-2. 
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Table 2-52. Additional MSRs Supported by the 4th and 5th Generation Intel® Xeon® Scalable Processor Families 


(CPUID Signature DisplayFamily_DisplayModel Values of O6_8FH and 06_CFH) (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


5663 


Register Address: 1600H—161FH, 5632— | IA32_LBR_x_TO_IP 


See Table 2-2. 


Last Branch Record Entry X Destination IP Register (R/W) 


2.17.9 
Architecture 


MSRs Introduced in the Intel® Core™ Ultra 7 Processor Supporting Performance Hybrid 


Table 2-53 lists additional MSRs for the Intel Core Ultra 7 processor with a CPUID Signature DisplayFamily_Display- 
Model value of 06_AAH. Table 2-54 lists the MSRs unique to the processor P-core. Table 2-55 lists the MSRs unique 


to the processor E-core. 


Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 


Architecture 


Register Address: Hex, Decimal 


Register Name 


This register is used by BIOS to program Trace Hub STH base address that will be used by AET messages. 


Register Information / Bit Fields Bit Description Scope 
Register Address: 33H, 51 MSR_MEMORY_CTRL 
Memory Control Register Core 
26:0 Reserved. 
27 UC_STORE_THROTTLE 
If set to 1, when enabled, the processor will only allow one in- 
progress UC store at a time. 
28 UC_LOCK_DISABLE 
If set to 1, a UC lock will cause a #GP(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 
29 SPLIT_LOCK_DISABLE 
If set to 1, a split lock will cause an #AC(O) exception. 
See Section 9.1.2.3, “Features to Disable Bus Locks.” 
63:30 Reserved. 
Register Address: 7AH, 122 IA32_FEATURE_ACTIVATION 
Feature Activation (R/W) 
Implements Feature Activation command. WRMSR to this address activates all ‘activatable’ features on this thread. 
See Table 2-2. 
Register Address: 80H, 128 MSR_TRACE_HUB_STH_ACPIBAR_BASE 
MSR_TRACE_HUB_STH_ACPIBAR_BASE (R/W) Thread 


0 


LOCK 


Lock bit. If set, this MSR cannot be re-written anymore. The lock 


bit has to be set in order for the AET packets to be directed to 
Trace Hub MMIO. 


Reserved. 
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Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 
Architecture (Contd.) 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 
45:18 ADDRESS 
AE€T target address in Trace Hub MMIO space. 
63:46 Reserved. 


Register Address: E2H, 226 


MSR_PKG_CST_CONFIG_CONTROL 


C-State Configuration (R/W) 


Core 


3:0 


7:4 


PKG_C_STATE_LIMIT 


Specifies the lowest processor-specific C-state code name 
(consuming the least power) for the package. 


The default is set as factory-configured package C-state limit. 
The following C-state code name encodings may be supported: 
O000b: CO/C1 (no package C-state support) 

0001b: C2 

001 0b: C3 

0011b: C6 

0100b: C7 

0101b: C7s 

0110b: C8 

0111b: C9 

1000b: C10 


MAX_CORE_C_STATE 


Possible values are: OO00—reserved; 0001—C1; 0010—C3, 
0011—C6. 


9:8 


Reserved. 


10 


14:11 


IO_MWAIT_REDIRECTION_ENABLE 


When set, will map |O_read instructions sent to IO registers 
PMG_IO_BASE_ADDR.PMBO+0/1/2 to MWAIT(C2,3,4) instructions; 
applies to deepc4 too. 


Reserved. 


iS) 


CFG_LOCK 


When set, locks bits 15:0 of this register for further writes, until 
the next reset occurs. 


24:16 


Reserved. 


25 


C3_STATE_AUTO_DEMOTION_ENABLE 


When set, processor will conditionally demote C6/C7 requests to 
C3 based on uncore auto-demote information. 


26 


C1_STATE_AUTO_DEMOTION_ENABLE 


When set, processor will conditionally demote C3/C6/C7 requests 
to C1 based on uncore auto-demote information. 


a7 


ENABLE_C3_UNDEMOTION 
Enable Un-Demotion from Demoted C3. 
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Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 


Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


28 


ENABLE_C1_UNDEMOTION 
Enable Un-Demotion from Demoted C1. 


29 


ENABLE_PKGC_AUTODEMOTION 

Enable Package C-State Auto-Demotion. It enables use of the 
history of past package C-state depth and residence, as a factor in 
determining C-State depth. 


30 


ENABLE_PKGC_UNDEMOTION 
Enable Package C-State Un-Demotion. It enables considering 


cases where demotion was the incorrect decision in determining 
C-State depth. 


31 


TIMED_MWAIT_ENABLE 


When set, enables Timed MWAIT feature. MWAIT would #GP on 
attempts to do setup MWAIT timer if this bit is not set. 


63:32 


Reserved. 


Register Address: E4H, 228 
10 Capture Base (R/W) 


MSR_IO_CAPTURE_BASE 


Power Management IO Redirection in C-state. See http://biosbits.org. 


15:0 


LVL_2_BASE_ADDRESS 


Specifies the base address visible to software for IO redirection. If 
MSR_PKG_CST_CONFIG_CONTROL.IO_MWAIT_REDIRECTION_ENA 
BLE, reads to this address will be consumed by the power 
management logic and decoded to MWAIT instructions. When IO 
port address redirection is enabled, this is the lO port address 
reported to the OS/software. 


Core 


18:16 


CST_RANGE 


Specifies the encoding value of the maximum C-State code name 
to be included when IO read to MWAIT redirection is enabled by 
MSR_PKG_CST_CONFIG_CONTROL.IO_MWAIT_REDIRECTION_ENA 
BLE: 


OOO0b—C3 is the max C-State to include. 
001b—C6 is the max C-State to include. 
010b—C7 is the max C-State to include. 


63:19 


Reserved. 


Register Address: 13CH, 316 
AES Feature Configuration (R/W) 


MSR_FEATURE_CONFIG 


Core 


0 


AESNI_LOCK 
Once this bit is set, writes to this register will not be allowed. 


AESNI_DISABLE 


This bit disables Advanced Encryption Standard feature on this 
processor core. To disable AES, BIOS will write ‘11 to this MSR on 
every core. 


63:2 


Reserved. 


Register Address: 140H, 320 


MSR_FEATURE_ENABLES 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Feature Enable (R/W) Thread 
Miscellaneous enables for thread specific features. 
0 CPUID_GP_ON_CPL_GT_O 
Causes CPUID to #GP if CPL greater than O and not in SMM. 
63:1 Reserved. 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target (R/W) Package 
Legacy register holding temperature related constants for Platform use. 
6:0 TCC Offset Time Window 
Describes the RATL averaging time window. 
7 TCC Offset Clamping Bit 
When enabled will allow RATL throttling below P1. 
15:8 Temperature Control Offset 
Fan Temperature Target Offset (a.k.a. T-Control) indicates the 
relative offset from the Thermal Monitor Trip Temperature at 
which fans should be engaged. 
23:16 TCC Activation Temperature 
The minimum temperature at which PROCHOT# will be asserted. 
The value is degrees C. 
30:24 TCC Activation Offset 
Specifies a temperature offset in degrees C from the temperature 
target (bits 23:16). PROCHOT# will assert at the offset target 
temperature. Write is permitted only if 
MSR_PLATFORM_INFO[30] is set. 
31 LOCKED 
When set, this entire register becomes read-only. 
63:2 Reserved. 
Register Address: 1A4H, 420 MSR_PREFETCH_CONTROL 
PREFETCH Control (R/W) Thread 


Prefetch disable bits. 


0 


L2_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L2 hardware prefetcher, which fetches 
additional lines of code or data into the L2 cache. 


L2_ADJACENT_CACHE_LINE_PREFETCHER_DISABLE 


If 1, disables the adjacent cache line prefetcher, which fetches the 
cache line that comprises a cache line pair (128 bytes). 


DCU_HARDWARE_PREFETCHER_DISABLE 


If 1, disables the L1 data cache prefetcher, which fetches the next 
cache line into L1 data cache. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
S DCU_IP_PREFETCHER_DISABLE 
If 1, disables the L1 data cache IP prefetcher, which uses 
sequential load history (based on instruction pointer of previous 
loads) to determine whether to prefetch additional lines. 
4 DCU_NEXT_PAGE_PREFETCH_DISABLE 
If 1, disables Next Page prefetcher. 
5 AMP_PREFETCH_DISABLE 
If 1, disables L2 Adaptive Multipath Probability (AMP) prefetcher. 
6 LLC_PAGE_PREFETCH_DISABLE 
If 1, disables the LLC Page prefetcher. 
7 AOP_PREFETCH_DISABLE 
8 STREAM_PREFETCH_CODE_FETCH_DISABLE 
63:9 Reserved. 
Register Address: 1A6H, 422 MSR_OFFCORE_RSP_O 
OFFCORE_RSP_O (R/W) Thread 


Offcore Response Event Select Register 


0 


TRUE_DEMAND_CACHE_LOAD 


Demand Data Rd = DCU reads (includes partials) that is not tagged 
homeless. 


DEMAND_RFO 


Demand Instruction fetch = IFU Fetches. ItoM or RFO that is not 
tagged homeless. 


DEMAND_CODE_READ 
Demand Instruction fetch = IFU Fetches. CRd or CRd_UC. 


CORE_MODIFIED_WRITEBACK 
WBMtol or WBMto€. 


HW_PREFETCH_MLC_LOAD 


L2 prefetcher requests triggered by reads from MEC (except 
those triggered by I-side). 


HW_PREFETCH_MLC_RFO 
L2 prefetcher requests triggered by RFOs. 


HW_PREFETCH_MLC_CODE 
L2 prefetcher requests triggered by I-side requests. 


HW_PREFETCH_LLC_LOAD 
LLC prefetch requests triggered by DRd. 


HW_PREFETCH_LLC_RFO 
LLC prefetch requests triggered by RFO. 


HW_PREFETCH_LLC_CODE 
LLC prefetch requests triggered by CRd. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


L1_HWPREFETCH 


Covers Hardware PFRFO, PFNEAR, PFMED, PFFAR, PFHW, PFNTA, 
PFNPP, PFIPP including the homeless versions. 


ALL_STREAMING_STORE 
Write Combining. WCiL or WCILF. 


CORE_NON_MODIFIED_WB 
WBEFtol or WBEFtoE. 


LLC_PREFETCH 
LLC prefetch of load/code/RFO. 


L1_SWPREFETCH 


Covers Software PFRFO, PFNEAR, PFMED, PFFAR, PFHW, PFNTA, 
PFNPP, PFIPP including the homeless versions. 


OTHER 


Includes CLFlush, CLFlushOPT, CLDemote, CLWB, Enqueue 
SetMonitor, Portln, IntA, Lock, SplitLock, Unlock, SpCyc, ClrMonitor, 
PortOut, IntPriUp, IntLog, IntPhy, EOI, RdCurr, WbStol, LLCWBinv, 
LLCInv, NOP, PCOMMIT. 


ANY_RESP 
Match on any response. 


SUPPLIER_NONE 
No Supplier Details. DATA_PRE [6:3] = 0. 


LLC_HIT_M_STATE 
LLC/L3, M-state, DATA_PRE [6:3] = 2. 


LLC_HIT_E_STATE 
LLC/L3, E-state, DATA_PRE [6:3] = 4. 


20 


ULCAIT_S_STATE 
LLC/L3, S-state, DATA_PRE [6:3] = 6. 


21 


LLC_HIT_F_STATE 
LLC/L3, F-state, DATA_PRE [6:3] = 8. 


c2 


FAR_MEM_LOCAL 
Far Memory, Local, DATA_PRE [6:3] = 1. 


23 


FAR_MEM_REMOTE_O_HOP 
Far Memory, Remote O-hop, DATA_PRE [6:3] = 3. 


24 


FAR_MEM_REMOTE_1_HOP 
Far Memory, Remote 1-hop, DATA_PRE [6:3] = 5. 


25 


FAR_MEM_REMOTE_2_PLUS_HOP 
Far Memory, Rem 2+ hop, DATA_PRE [6:3] = 7. 


26 


NEAR_MEM_MISS_LOCAL_NODE 
LLC Miss Local Node. Near Memory, Local DATA_PRE [6:3] = €. 


27 


NEAR_MEM_REMOTE_O_HOP 
Near Memory, Remote O-hop, DATA_PRE [6:3] = B 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


28 NEAR_MEM_REMOTE_1_HOP 
Near Memory, Remote 1-hop, DATA_PRE [6:3] = D. 

29 NEAR_MEM_REMOTE_2_PLUS_HOP 
Near Memory, Remote 2+ hop, DATA_PRE [6:3] = F. 

30 SPL_HIT 
Snoop Info: SPL-hit, DATA_PRE [2:0] = 6. 

31 SNOOP_NONE 
No details as to Snoop-related info. Snoop Info: None, DATA_PRE 
[2:0] = 0. 

32 NOT_NEEDED 
No snoop was needed to satisfy the request. Snoop Info: Not 
needed, DATA_PRE [2:0] = 1. 

33 MISS 
No snoop was needed to satisfy the request. Snoop Info: Miss, 
DATA_PRE [2:0] = 2. 

34 HIT_NO_FWD 
A snoop was needed and it Hits in at least one snooped cache. Hit 
denotes a cache-line was valid before snoop effect. Snoop Info: 
Hit No Fwd, DATA_PRE [2:0] = 3. 

35 HIT_EF_WITH_FWD 
A snoop was needed and data was Forwarded from a remote 
socket. Snoop Info: Hit EF w/Fwd, DATA_PRE [2:0] = 4. 

36 HITM 
A snoop was needed and it HitMed in local or remote cache. HitM 
denotes a cache-line was modified before snoop effect. Snoop 
Info: HitM, DATA_PRE [2:0] = 5. 

37 NON_DRAM 
Target was non-DRAM system address. Snoop Info: HitM, 
DATA_PRE [2:0] = 5. 

38 GO_ERR 
GO-ERR, RspData[3:0] = 0100. 

39 GO_NO_GO 
GO-NoGO, RspData[3:0] = 0111. 

40 INPKG_MEM_LOCAL 
In-package Memory, Local, DATA_PRE [6:3] = 9. 

41 INPKG_MEM_NONLOCAL 
In-package Memory, Non-Local, DATA_PRE [6:3] = C. 

43:42 Reserved. 

44 UC_LOAD 
PRd or UCRdF. 

45 UC_STORE 
WiL. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
46 PARTIAL_STREAMING_STORES 
WCIL. 
47 FULL_STREAMING_STORES 
WCILF. 
48 L1_MODIFIED_WB 
EVICTION EXTTYPE from MEC. 
49 L2_MODIFIED_WB 
WBMtol or WBMtoE. 
50 PSMI 
MemPushWr_NS (PSMI only). 
51 ITOM 
ItoM. 
63:52 Reserved. 
Register Address: 1A7H, 423 MSR_OFFCORE_RSP_1 
OFFCORE_RSP_1 (R/W) Thread 
Offcore Response Event Select Register. See MSR_OFFCORE_RSP_O (at1A6H). 
Register Address: 1AAH, 426 MSR_MISC_PWR_MGMT 
Miscellaneous Power Management Control (R/W) Package 


Various model-specific features enumeration. See http://biosbits.org. 


0 Reserved. 

1 ENABLE_HWP_VOTING_RIGHT 
When set (1), The CPU will take into account thread HWP requests 
for threads that have voting rights only (ignores thread requests 
if they do not have voting rights). When reset(O), The CPU will 
take into account all thread HWP requests, even for threads that 
don't have voting rights. Setting this bit will cause the HWP Base 
feature bit to be reported in CPUID as present; clearing will cause 
it to be reported as non-present. 

Siz Reserved. 
ENABLE_HWP 
Setting this bit will cause the HWP Base feature bit to report as 
present in CPUID; clearing this bit will cause CPUID to report the 
feature as non-present. 

re ENABLE_HWP_INTERRUPT 
Setting this bit will cause the HWP Interrupt feature 
CPUID[6].EAX[8] bit to report as present; clearing will report as 
non-present. 

8 ENABLE_OUT_OF_BAND_AUTONOMOUS 
Setting this bit will cause the HWP Autonomous feature bit to 
report as present; clearing will report as non-present. 

9 Reserved. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
12 ENABLE_HWP_EPP 
Enable HWP EPP. Setting this bit (1) will cause the HWP 
CPUID[6].EAX[1 0] Energy Performance Preference bit to report 
as present (1); clearing will report as non-present (0). 
13 LOCK 
Setting this bit will prevent the BIOS specific bits from changing 
until the next reset. i.e., only Bits [0,22] which are meant for OS 
use can be changed once the LOCK bit is set. 
63:14 Reserved. 
Register Address: 1ADH, 429 MSR_PRIMARY_TURBO_RATIO_LIMIT 
Primary Maximum Turbo Ratio Limit (R/W) Package 
Software can configure these limits when MSR_PLATFORM_INFO[28] = 1. Specifies Maximum Ratio Limit for each 
group. Maximum ratio for groups with more cores must decrease monotonically. 
7:0 MAX_TURBO_GROUP_0O: 
Maximum turbo ratio limit with 1 core active. 
15:8 MAX_TURBO_GROUP_1: 
Maximum turbo ratio limit with 2 cores active. 
23:16 MAX_TURBO_GROUP_2: 
Maximum turbo ratio limit with 3 cores active. 
31:24 MAX_TURBO_GROUP_3: 
Maximum turbo ratio limit with 4 cores active. 
39:32 MAX_TURBO_GROUP_4: 
Maximum turbo ratio limit with 5 cores active. 
47:40 MAX_TURBO_GROUP_5S: 
Maximum turbo ratio limit with 6 cores active. 
55:48 MAX_TURBO_GROUP_6: 
Maximum turbo ratio limit with 7 cores active. 
63:56 MAX_TURBO_GROUP_7: 
Maximum turbo ratio limit with 8 cores active. 
Register Address: 1F1H, 497 MSR_CRASHLOG_CONTROL 
Crash Log Control (R/W) Thread 


Write data to a Crash Log configuration. 


0 


CDDIS 


CrashDump_Disable: If set, indicates that Crash Dump is disabled. 


EN_GPRS 


Collect GPRs on a crash dump. Only meaningful when CDDIS is 
zero. 


EN_GPRS_IN_SMM 


Collect GPRs in SMM on a crash dump. Only meaningful when 
CDDIS is zero. EN_GPRS will override this control, 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 

3 TRIPLE_FAULT_SHUTDOWN 
Collect a crash log on a triple fault shutdown. Only meaningful 
when CDDIS is zero. 

63:4 Reserved. 

Register Address: 1F5H, 501 MSR_PRMRR_PHYS_MASK 

Processor Reserved Memory Range Register - Physical Mask (R/W) Core 

9:0 Reserved. 

10 LOCK 
Once set, this bit prevents software from modifying the PRMRR. 

11 VALID 
This bit serves as the enable for the PRMRR; the PRMRR must be 
LOCKed before it can be enabled. 

19:12 Reserved. 

45:20 MASK 
PRMRR Address Mask. 

63:46 Reserved. 

Register Address: 1FCH, 508 MSR_POWER_CTL 

Power Control Register (R/W) Package 

See http://biosbits.org. 

0 ENABLE_BIDIR_PROCHOT 
Used to enable or disable the response to PROCHOT# input. 
When set/enabled, the platform can force the CPU to throttle to a 
lower power condition such as Pn/Pm by asserting prochot#. 
When clear/disabled (default), the CPU ignores the status of the 
prochot input signal. 

1 C1E_ENABLE 
When set to ‘1’, will enable the CPU to switch to the Minimum 
Enhanced Intel SpeedStep Technology operating point when all 
execution cores enter MWAIT (C1). 

2 SAPM_IMC_C2_POLICY 
This bit determines if self-refresh activation is allowed when 
entering Package C2 State. If it is set to Ob, PCODE will keep the 
FORCE_SR_OFF bit asserted in Package C2 State and allow its 
negation according to the defined latency negotiations with the 
PCH and Display Engine in Package C3 and deeper states. 
Otherwise, self-refresh is allowed in Package C2 State. 

3 FAST_BRK_SNP_EN 


This bit controls the VID swing rate for the OTHER_SNP_WAKE 
events that are detected by the iMPH. This is the event that is 
detected by the iIMPH when a non-DMI snoopable request is 
observed while UCLK domain is not functional. 

Ob: Use slow VID swing rate. 


1b: Use fast VID swing rate. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


17:4 


Reserved. 


18 


PWR_PERF_PLTFRM_OVR 
Power performance platform override. 


19 


20 


€E_TURBO_DISABLE 


Setting this bit disables the P-States energy efficiency 
optimization. Default value is 0. Disable/enable the energy 
efficiency optimization in P-State legacy mode (when 
IA32_PM_ENABLE[HWP_ENABLE] = 0), has an effect only in the 
turbo range or into PERF_MIN_CTL value if it is not zero set. In 
HWP mode (IA32_PM_ENABLE[HWP_ENABLE] == 1), has an 
effect between the OS desired or OS maximize to the OS minimize 
performance setting. 


RTH_DISABLE 


Setting this bit disables the Race to Halt optimization and avoids 
this optimization limitation to execute below the most efficient 
frequency ratio. Default value is O for processors that support 
Race to Halt optimization. 


21 


DIS_PROCHOT_OUT 
Prochot output disable. 


£2 


PROCHOT_RESPONSE 
Prochhot configurable response enable. 


23 


VR_THERM_ALERT_DISABLE_LOCK 


When set to 1, locks PROCHOT related bits of this MSR. Once set, 
a reset is required to clear this bit. 


24 


VR_THERM_ALERT_DISABLE 
When set to 1, disables the VR_THERMAL_ALERT signaling. 


29 


DISABLE_RING_EE 
Disable Ring EE. 


26 


DISABLE_SA_OPTIMIZATION 
Disable SA optimization. 


£7 


DISABLE_OOK 
Disable OOK. 


28 


DISABLE_AUTONOMOUS 
Disable HWP autonomous mode. 


29 
30 


Reserved. 


CSTATE_PREWAKE_DISABLE 
C-state pre-wake disable. 


63:31 


Reserved. 


Register Address: 2AQH, 672 


MSR_PRMRR_BASE_O 


Processor Reserved Memory Range Register - Physical Base Control Register (R/W) 


Core 


2:0 


MEMTYPE 
Memory type for PRMRR accesses. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 

3 CONFIGURED 

PRMRR base configured. 
19:4 Reserved. 
45:20 BASE 

PRMRR base address. 
63:46 Reserved. 
Register Address: 474H, 1140 IA32_MG29_ ET 
MC29_CTL. See Table 2-2. Package 
Register Address: 475H, 1141 IA32_MC29_STATUS 
MC29_STATUS. See Table 2-2. Package 
Register Address: 476H, 1142 IA32_MC29_ADDR 
MC29_ADDR. See Table 2-2. Package 
Register Address: 477H, 1143 IA32_MC29_ MISC 
MC29_MISC. See Table 2-2. Package 
Register Address: 478H, 1144 IA32_MC30_CTL 
MC30_CTL. See Table 2-2. Package 
Register Address: 479H, 1145 IA32_MC30_STATUS 
MC30_STATUS. See Table 2-2. Package 
Register Address: 47AH, 1146 IA32_MC30_ADDR 
MC30_ADDR. See Table 2-2. Package 
Register Address: 47BH, 1147 IA32_MC30_MISC 
MC30_MISC. See Table 2-2. Package 
Register Address: 47CH, 1148 IA32_MC31_CTL 
MC31_CTL. See Table 2-2. Package 
Register Address: 47DH, 1149 IA32_MC31_STATUS 
MC31_STATUS. See Table 2-2. Package 
Register Address: 47EH, 1150 IA32_MC31_ADDR 
MC31_ADDR. See Table 2-2. Package 
Register Address: 47FH, 1151 IA32_MC31_MISC 
MC31_MISC. See Table 2-2. Package 
Register Address: 4E€0H, 1248 MSR_SMM_FEATURE_CONTROL 
Enhanced SMM Feature Control (R/W) Package 


Reports SMM capability enhancement. 


0 


LOCK 
When set, locks this register from further changes. 
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Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 


Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
1 SMM_CPU_SAVE_EN 
If 0, SMI/RSM will save/restore state in SMRAM 
If 1, SMI/RSM will save/restore state from SRAM. 
2 SMM_CODE_CHK_EN 
When clear (default) none of the logical processors are prevented 
from executing SMM code outside the ranges defined by the 
SMRR. When set, any logical processor in the package that 
attempts to execute SMM code not within the ranges defined by 
the SMRR will assert an unrecoverable MCE. 
63:3 Reserved. 
Register Address: 601H, 1537 MSR_VR_CURRENT_CONFIG 
Power Limit 4 (PL4) (R/W) Package 
Package-level maximum power limit (in Watts). It is a proactive, instantaneous limit. 
15:0 CURRENT_LIMIT 
PL4 Value in 0.125 A increments. This field is locked by 
MSR_VR_CURRENT_CONFIG.LOCK. When the LOCK bit is set to 1, 
this field becomes Read Only. 
30:16 Reserved. 
31 LOCK 
This bit will lock the CURRENT_LIMIT settings in this register and 
will also lock this setting. This means that once set to 1, the 
CURRENT_LIMIT setting and this bit become Read Only until the 
next Warm Reset. 
63:32 Reserved. 
Register Address: 620H, 1568 MSR_UNCORE_RATIO_LIMIT 
Uncore Ratio Limit (R/W) Package 
Min/Max Ratio Limits for Uncore LLC and Ring. 
6:0 MAX_CLR_RATIO 
Maximum allowed ratio for the Ring and Last Level Cache (LLC). 
7 Reserved. 
14:8 MIN_CLR_RATIO 
Minimum allowed ratio for the Ring and Last Level Cache (LLC). 
63:15 Reserved. 
Register Address: 638H, 1592 MSR_PPO_POWER_LIMIT 
MSR_PPO_POWER_LIMIT (R/W) Package 


PPO RAPL power unit control. 


14:0 


IA_PP_PWR_LIM 
This is the power limitation on the IA cores power plane. 


The unit of measurement is defined in 
PACKAGE_POWER_SKU_UNIT_MSR[PWR_UNIT]. 
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Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 


Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


PWR_LIM_CTRL_EN 


This bit must be set in order to limit the power of the IA cores 
power plane. 


Ob: IA cores power plane power limitation is disabled. 
1b: IA cores power plane power limitation is enabled. 


PP_CLAMP_LIM 

Power Plane Clamping limitation; allow going below P1. 
Ob: PBM is limited between P1 and PO. 

1b: PBM can go below P1. 


e337 


CTRL_TIME_WIN 

x = CTRL_TIME_WIN[23:22] 

y = CTRL_TIME_WIN[21:17] 

The timing interval window is Floating Point number given by 1.x 
* power(2,y). 

The unit of measurement is defined in 
PACKAGE_POWER_SKU_UNIT_MSR[TIME_UNIT]. 

The maximal time window is bounded by 
PACKAGE_POWER_SKU_MSR[PKG_MAX_WIN]. The minimum time 
window is 1 unit of measurement (as defined above). 


30:24 
=i 


Reserved. 


PP_PWR_LIM_LOCK 


When set, all settings in this register are locked and are treated as 
Read Only. 


63:32 


Reserved. 


Register Address: 64FH, 1615 


MSR_CORE_PERF_LIMIT_REASONS 


Core Performance Limit Reasons 


Indicator of Frequency Clipping in Processor Cores. (Frequency refers to processor core frequency.) 


0 


PROCHOT (R/O) 

PROCHOT Status. When set, frequency is reduced below the 
operating system request due to assertion of external PROCHOT. 
THERMAL (R/O) 


Thermal Status. When set, frequency is reduced below the 
operating system request due to a thermal event. 


Package 


Reserved. 


RSR_LIMIT (R/O) 

Residency State Regulation Status. When set, frequency is 
reduced below the operating system request due to residency 
state regulation limit. 


RATL (R/O) 
Running Average Thermal Limit Status. When set, frequency is 


reduced below the operating system request due to Running 
Average Thermal Limit (RATL). 
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Table 2-53. Additional MSRs Supported by the Intel® Core™ Ultra 7 Processors Supporting Performance Hybrid 


Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


6 VR_THERMALERT (R/O) 
VR Therm Alert Status. When set, frequency is reduced below the 
operating system request due to a thermal alert from a processor 
Voltage Regulator (VR). 

Y VR_TDC (R/O) 
VR Therm Design Current Status. When set, frequency is reduced 
below the operating system request due to VR thermal design 
current limit. 

8 OTHER (R/O) 
Other Status. When set, frequency is reduced below the operating 
system request due to electrical or other constraints. 

9 Reserved. 

10 PBM_PL1 (R/O) 
Package/Platform-Level Power Limiting PL1 Status. When set, 
frequency is reduced below the operating system request due to 
package/platform-level power limiting PL1. 

11 PBM_PL2 (R/O) 
Package/Platform-Level PL2 Power Limiting Status. When set, 
frequency is reduced below the operating system request due to 
package/platform-level power limiting PL2/PL3. 

12 MAX_TURBO_LIMIT (R/O) 
Max Turbo Limit Status. When set, frequency is reduced below 
the operating system request due to multi-core turbo limits. 

13 TURBO_ATTEN (R/O) 
Turbo Transition Attenuation Status. When set, frequency is 
reduced below the operating system request due to Turbo 
transition attenuation. This prevents performance degradation 
due to frequent operating ratio changes. 

15:14 Reserved. 

16 PROCHOT_LOG (R/W) 
PROCHOT Log. When set, indicates that the PROCHOT Status bit 
has asserted since the log bit was last cleared. This log bit will 
remain set until cleared by software writing 0. 

IZ THERMAL_LOG (R/W) 
Thermal Log When set, indicates that the Thermal Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing 0. 

19:18 Reserved. 

20 RSR_LIMIT_LOG (R/W) 


Residency State Regulation Log. When set, indicates that the 
Residency State Regulation Status bit has asserted since the log 
bit was last cleared. This log bit will remain set until cleared by 
software writing 0. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


21 


RATL_LOG (R/W) 


Running average thermal limit Log, RW, When set by PCODE 
indicates that Running average thermal limit has cause IA 
frequency clipping. Software should write to this bit to clear the 
status in this bit. 


22 


VR_THERMALERT_LOG (R/W) 


VR Therm Alert Log. When set, indicates that the VR Therm Alert 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 


23 


VR_TDC_LOG (R/W) 


VR Thermal Design Current Log. When set, indicates that the VR 
TDC Status bit has asserted since the log bit was last cleared. This 
log bit will remain set until cleared by software writing O. 


24 


25 


OTHER_LOG (R/W) 


Other Log. When set, indicates that the Other Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing O. 


Reserved. 


26 


PBM_PL1_LOG (R/W) 


Package/Platform-Level PL1 Power Limiting Log. When set, 
indicates that the Package or Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 


27 


PBM_PL2_LOG (R/W) 


Package/Platform-Level PL2 Power Limiting Log. When set, 
indicates that the Package or Platform Level PL2/PL3 Power 
Limiting Status bit has asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing 0. 


28 


MAX_TURBO_LIMIT_LOG (R/W) 


Max Turbo Limit Log. When set, indicates that the Max Turbo Limit 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 


(AS) 


TURBO_ATTEN_LOG (R/W) 


Turbo Transition Attenuation Log. When set, indicates that the 
Turbo Transition Attenuation Status bit has asserted since the log 
bit was last cleared. This log bit will remain set until cleared by 
software writing 0. 


63:30 


Reserved. 


Register Address: 650H, 1616 


MSR_SECONDARY_TURBO_RATIO_LIMIT 


Secondary Maximum Turbo Ratio Limit (R/W) 
Software can configure these limits when MSR_PLATFORM_INFO[28] = 1. 


Specifies Maximum Ratio Limit for each group. Maximum ratio for groups with more cores must decrease 
monotonically. 


Package 


7:0 


MAX_TURBO_GROUP_O: 
Maximum turbo ratio limit with 1 core active. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
15:8 MAX_TURBO_GROUP_1: 
Maximum turbo ratio limit with 2 cores active. 
23:16 MAX_TURBO_GROUP_2: 
Maximum turbo ratio limit with 3 cores active. 
31:24 MAX_TURBO_GROUP_3: 
Maximum turbo ratio limit with 4 cores active. 
39:32 MAX_TURBO_GROUP_4: 
Maximum turbo ratio limit with 5 cores active. 
47:40 MAX_TURBO_GROUP_5S: 
Maximum turbo ratio limit with 6 cores active. 
55:48 MAX_TURBO_GROUP_6: 
Maximum turbo ratio limit with 7 cores active. 
63:56 MAX_TURBO_GROUP_7: 
Maximum turbo ratio limit with 8 cores active. 
Register Address: 65CH, 1628 MSR_PLATFORM_POWER_LIMIT 
Platform Power Limit Control (R/W) Package 


Allows platform BIOS to limit power consumption of the platform devices to the specified values. The Long Duration 
power consumption is specified via Platform_Power_Limit_1 and Platform_Power_Limit_1_Time. The Short Duration 
power consumption limit is specified via the Platform_Power_Limit_2 with duration chosen by the processor. The 
processor implements an exponential-weighted algorithm in the placement of the time windows. 


14:0 


POWER_LIMIT_1 


Average Power limit value which the platform must not exceed 
over a time window as specified by Power_Limit_1_TIME field. 
The default value is the Thermal Design Power (a.k.a TDP) and 
varies with product skus. The unit is specified in 
MSR_RAPLPOWER_UNIT. 


POWER_LIMIT_1_EN 

When set, enables the processor to apply control policy such that 
the platform power does not exceed Platform Power limit 1 over 
the time window specified by Power Limit 1 Time Window. 


CRITICAL_POWER_CLAMP_1 


When set, allows the processor to go below the OS requested P 
states in order to maintain the power below specified Platform 
Power Limit 1 value. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


23:7 


POWER_LIMIT_1_TIME 

Specifies the duration of the time window over which Platform 
Power Limit 1 value should be maintained for sustained long 
duration. This field is made up of two numbers from the following 
equation: 

Time Window = (float) ((1+(X/4))*(2Y)), where: 

X = POWER_LIMIT_1_TIME[23:22] 

Y = POWER_LIMIT_1_TIME[21:17] 

The maximum allowed value in this field is defined in 
MSR_PKG_POWER_INFO[PKG_MAX_WIN]. 


The default value is ODH, The unit is specified in 
MSR_RAPLPOWER_UNIT[Time Unit] 


31:24 
46:32 


Reserved. 


POWER_LIMIT_2 


Average Power limit value which the platform must not exceed 
over the Short Duration time window chosen by the processor. 
The recommended default value is 1.25 times the Long Duration 
Power Limit (i.e., Platform Power Limit 1). 


47 


POWER_LIMIT_2_EN 


When set, enables the processor to apply control policy such that 
the platform power does not exceed Platform Power limit 2 over 
the Short Duration time window. 


48 


CRITICAL_POWER_CLAMP_2 


When set, allows the processor to go below the OS requested P 
states in order to maintain the power below specified Platform 
Power Limit 2 value. 


62:49 


Reserved. 


63 


LOCK 


Setting this bit will lock all other bits of this MSR until system 
RESET. 


Register Address: 6BOH, 1712 


MSR_GRAPHICS_PERF_LIMIT_REASONS 


MSR_GRAPHICS_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in the Processor Graphics. (Frequency refers to processor graphics frequency.) 


0 


PROCHOT (R/O) 


PROCHOT Status. When set, frequency is reduced due to 
assertion of external PROCHOT. 


Package 


THERMAL (R/O) 


Thermal Status. When set, frequency is reduced due to a thermal 
event. 


Reserved. 
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reduced due to running average thermal limit. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


VR_THERMALERT (R/O) 


VR Therm Alert Status. When set, frequency is reduced due to a 
thermal alert from a processor Voltage Regulator. 


VR_TDC (R/O) 


VR Thermal Design Current Status. When set, frequency is 
reduced due to VR TDC limit. 


OTHER (R/O) 


Other Status. When set, frequency is reduced due to electrical or 
other constraints. 


Reserved. 


PBM_PL1 (R/O) 


Package/Platform-Level Power Limiting PL1 Status. When set, 
frequency is reduced due to package/platform-level power 
limiting PL1. 


PBM_PL2 (R/O) 


Package/Platform-Level PL2 Power Limiting Status. When set, 
frequency is reduced due to package/platform-level power 
limiting PL2/PL3. 


INEFFICIENT_OPERATION (R/O) 


Inefficient Operation Status. When set, processor graphics 
frequency is operating below target frequency. 


15:13 


Reserved. 


PROCHOT_LOG (R/W) 


PROCHOT Log. When set, indicates that the PROCHOT Status bit 
has asserted since the log bit was last cleared. This log bit will 
remain set until cleared by software writing 0. 


THERMAL_LOG (R/W) 


Thermal Log. When set, indicates that the Thermal Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing O. 


20:18 


Reserved. 


21 


RATL_LOG (R/W) 

Running Average Thermal Limit Log. When set, indicates that the 
RATL Status bit has asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 


22 


VR_THERMALERT_LOG (R/W) 


VR Therm Alert Log. When set, indicates that the VR Therm Alert 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 


23 


VR_TDC_LOG (R/W) 


VR Thermal Design Current Log. When set, indicates that the VR 
Therm Alert Status bit has asserted since the log bit was last 
cleared. This log bit will remain set until cleared by software 
writing O. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 

24 OTHER_LOG (R/W) 
Other Log. When set, indicates that the OTHER Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing O. 

25 Reserved. 

26 PBM_PL1_LOG (R/W) 
Package/Platform-Level PL1 Power Limiting Log. When set, 
indicates that the Package/Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 

ey PBM_PL2_LOG (R/W) 
Package/Platform-Level PL2 Power Limiting Log. When set, 
indicates that the Package/Platform Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 

28 INEFFICIENT_OPERATION_LOG (R/W) 
Inefficient Operation Log. When set, indicates that the Inefficient 
Operation Status bit has asserted since the log bit was last 
cleared. This log bit will remain set until cleared by software 
writing O. 

63:29 Reserved. 

Register Address: 6B1H, 1713 MSR_RING_PERF_LIMIT_REASONS 

MSR_RING_PERF_LIMIT_REASONS Package 


Indicator of Frequency Clipping in the Ring Interconnect. (Frequency refers to ring interconnect in the uncore.) 


0 


PROCHOT (R/O) 


PROCHOT Status. When set, frequency is reduced due to 
assertion of external PROCHOT. 


THERMAL (R/O) 


Thermal Status. When set, frequency is reduced due to a thermal 
event. 


Reserved. 


RATL (R/O) 


Running Average Thermal Limit Status. When set, frequency is 
reduced due to running average thermal limit. 


VR_THERMALERT (R/O) 


VR Therm Alert Status. When set, frequency is reduced due to a 
thermal alert from a processor Voltage Regulator. 


VR_TDC (R/O) 


VR Thermal Design Current Status. When set, frequency is 
reduced due to VR TDC limit. 


OTHER (R/O) 


Other Status. When set, frequency is reduced due to electrical or 
other constraints. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 

9 Reserved. 

10 PBM_PL1 (R/O) 
Package/Platform-Level Power Limiting PL1 Status. When set, 
frequency is reduced due to package/platform-level power 
limiting PL1. 

11 PBM_PL2 (R/O) 
Package/Platform-Level PL2 Power Limiting Status. When set, 
frequency is reduced due to package/platform-level power 
limiting PL2/PL3. 

15:12 Reserved. 

16 PROCHOT_LOG (R/W) 
PROCHOT Log. When set, indicates that the PROCHOT Status bit 
has asserted since the log bit was last cleared. This log bit will 
remain set until cleared by software writing O. 

17 THERMAL_LOG (R/W) 
Thermal Log. When set, indicates that the Thermal Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing 0. 

20:18 Reserved. 

21 RATL_LOG (R/W) 
Running Average Thermal Limit Log. When set, indicates that the 
RATL Status bit has asserted since the log bit was last cleared. 
This log bit will remain set until cleared by software writing O. 

22 VR_THERMALERT_LOG (R/W) 
VR Therm Alert Log. When set, indicates that the VR Therm Alert 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 

23 VR_TDC_LOG (R/W) 
VR Thermal Design Current Log. When set, indicates that the VR 
Therm Alert Status bit has asserted since the log bit was last 
cleared. This log bit will remain set until cleared by software 
writing O. 

24 OTHER_LOG (R/W) 
Other Log. When set, indicates that the OTHER Status bit has 
asserted since the log bit was last cleared. This log bit will remain 
set until cleared by software writing O. 

25 Reserved. 

26 PBM_PL1_LOG (R/W) 


Package/Platform-Level PL1 Power Limiting Log. When set, 
indicates that the Package/Platform Level PL1 Power Limiting 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 
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Architecture (Contd.) 


Register Address: Hex, Decimal 


Register Name 


MSR to read TME_ACTIVATE[MK_TME_KEYID_BITS]. 


Register Information / Bit Fields Bit Description Scope 
27 PBM_PL2_LOG (R/W) 
Package/Platform-Level PL2 Power Limiting Log. When set, 
indicates that the Package/Platform Level PL2 Power Limiting 
Status bit has asserted since the log bit was last cleared. This log 
bit will remain set until cleared by software writing O. 
63:28 Reserved. 
Register Address: 9FBH, 2555 IA32_TME_CLEAR_SAVED_KEY 
IA32_TME_CLEAR_SAVED_KEY (R/W) Package 
See Table 2-2. 
Register Address: 9FFH, 2559 MSR_CORE_MKTME_ACTIVATE 
MSR_CORE_MKTME_ACTIVATE (R/O) Core 


31:0 Reserved. 

35332 READ_MK_TME_KEYID_BITS 
This value will be returned on a RDMSR, but must be zero ona 
WRMSR. 

63:36 Reserved. 


The MSRs listed in Table 2-54 are unique to the Intel Core Ultra 7 processor P-core. These MSRs are not supported 


on the processor E-core. 


Table 2-54. MSRs Supported by the Intel® Core™ Ultra 7 Processor P-core 


Register Address: Hex, Decimal 


Register Name 


This register provides built-in support for Top-down Micro-architecture Analysis (TMA) metrics. It exposes the four 
TMA Level 1 metrics where the lower 32 bits are divided into four 8 bit fields, each of which is an integer percentage 
of the total TOPDOWN.SLOTS (as reported by fixed counter 3). 


Register Information / Bit Fields Bit Description Scope 
Register Address: 30CH, 780 IA32_FIXED_CTR3 
Fixed-Function Performance Counter 3 (R/W) Thread 
47:0 FIXED_COUNTER 
Top-down Microarchitecture Analysis unhalted number of available 
slots counter. 
63:48 Reserved. 
Register Address: 329H, 809 MSR_PERF_METRICS 
Performance Metrics (R/W) Thread 


7:0 RETIRING 
Percent of utilized by uops that eventually retire (commit). 
15:8 BAD_SPECULATION 


Percent of Wasted due to incorrect speculation, covering Utilized by 
uops that do not retire, or Recovery Bubbles (unutilized slots). 
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Register Address: Hex, Decimal 


Register Name 


See Table 2-44. 


Register Information / Bit Fields Bit Description Scope 
23:16 FRONTEND_BOUND 
Percent of Unutilized slots where Front-end did not deliver a uop 
while Back-end is ready. 
31:24 BACKEND_BOUND 
Percent of Unutilized slots where a uop was not delivered to Back- 
end due to lack of Back-end resources. 
39:32 MULTI_UOPS 
Frontend bound. 
47:40 BRANCH_MISPREDICTS 
Frontend bound. 
55:48 FRONTEND_LATENCY 
Frontend bound. 
63:56 MEMORY_BOUND 
Frontend bound. 
Register Address: 540H, 1344 MSR_THREAD_UARCH_CTL 
Thread Microarchitectural Control (R/W) Thread 
See Table 2-47. 
Register Address: 541H, 1345 MSR_CORE_UARCH_CTL 
Core Microarchitecture Control MSR (R/W) Core 


The MSRs listed in Table 2-48 are unique to the Intel Core Ultra 7 processor E-core. These MSRs are not supported 


on the processor P-core. 


Table 2-55. MSRs Supported by the Intel® Core™ Ultra 7 Processor E-core 


Register Address: Hex, Decimal 


Register Name 


If CPUID.(EAX=10H, ECX=1):EDX.COS_MAX[15:0] = 0. 


Controls MLC (L2) Intel RDT allocation. For more details on CAT/RDT, see Chapter 18, “Debug, Branch Profile, TSC, and 
Intel® Resource Director Technology (Intel? RDT) Features.” 


Register Information / Bit Fields Bit Description Scope 
Register Address: 4FOH, 1264 MSR_SAF_CTRL 
SAF Control (W/O) Package 
Extension to SAF. 
0 INVALIDATE_CURRENT_STRIDE 

Invalidate all chunks in current stride. 

63:1 Reserved. 
Register Address: D18H—D1FH, 3352—3359 IA32_L2_MASK_[8-15] 
IA32_L2_MASK_[8-15] (R/W) Module 


15:0 


WAY_MASK 


Capacity Bit Mask. Available ways vectors for class of service of 
IA core. ‘1 in bit indicates allocation to the way is allowed. ‘0 
indicates allocation to the way is not allowed. 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
31:16 Reserved. 
Register Address: 1309H—130BH, 4873 MSR_RELOAD_FIXED_CTRx 
—4875 
Reload value for IA32_FIXED_CTRx (R/W) Thread 
47:0 Value loaded into IA32_FIXED_CTRx when a PEBS record is 


generated while PEBS_EN_FIXEDx = 1 and PEBS_OUTPUT = 
01B in IA32_PEBS_ENABLE, and FIXED_CTRx is overflowed. 


63:48 Reserved. 

Register Address: 14C1H—14C8H, 5313 —5320 | MSR_RELOAD_PMCx 

Reload value for IA32_PMCx (R/W) Thread 
47:0 Value loaded into IA32_PMCx when a PEBS record is generated 


while PEBS_EN_PMCx = 1 and PEBS_OUTPUT = 018B in 
IA32_PEBS_ENABLE, and PMCx is overflowed. 


63:48 Reserved. 
Register Address: 1A8EH, 6798 MSR_STLB_FILL_TRANSLATION 
STLB Fill Translation (W/O) Core 
STLB QoS MSR to fill translations into STLB. 
3:0 CLOS 

Class of service to use for the fill. 
9:4 Reserved. 
10 xX 

Set to 1 when LA is to an executable page. 
11 RW 

Set to 1 when LA is to a writeable page. 
63:12 LA 

Logical address to use for fill. 


2.18 MSRSIN THE INTEL® XEON PHI” PROCESSOR 3200/5200/7200 SERIES 
AND THE INTEL® XEON PHI" PROCESSOR 7215/7285/7295 SERIES 


The Intel® Xeon Phi™ processor 3200, 5200, 7200 series, with a CPUID Signature DisplayFamily_DisplayModel 
value of 06_57H, supports the MSR interfaces listed in Table 2-56. These processors are based on the Knights 
Landing microarchitecture. The Intel® Xeon Phi™ processor 7215, 7285, 7295 series, with a CPUID Signature 
DisplayFamily_DisplayModel value of 06_85H, supports the MSR interfaces listed in Table 2-56 and Table 2-57. 
These processors are based on the Knights Mill microarchitecture. Some MSRs are shared between a pair of 
processor cores, and the scope is marked as module. 


Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: OH, O IA32_P5_MC_ADDR 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
See Section 2.23, "MSRs in Pentium Processors." Module 
Register Address: 1H, 1 IA32_P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors." Module 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination.” See Table 2-2. Thread 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and Table 2-2. Thread 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Package 
See Table 2-2. 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Thread 
Register Address: 34H, 52 MSR_SMI_COUNT 
SMI Counter (R/O) Thread 
31:0 SMI Count (R/O) 
63:32 Reserved. 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in Intel 64Processor (R/W) Thread 
See Table 2-2. 
0 Lock. (R/WL) 
1 Reserved. 
2 Enable VMX outside SMX operation. (R/WL) 
Register Address: 3BH, 59 IA32_TSC_ADJUST 
Per-Logical-Processor TSC ADJUST (R/W) Thread 
See Table 2-2. 
Register Address: 4EH, 78 IA32_PPIN_CTL (MSR_PPIN_CTL) 
Protected Processor Inventory Number Enable Control (R/W) Package 
0 LockOut (R/WO) 
See Table 2-2. 
1 Enable_PPIN (R/W) 
See Table 2-2. 
63:2 Reserved 
Register Address: 4FH, 79 IA32_PPIN (MSR_PPIN) 
Protected Processor Inventory Number (R/O) Package 
63:0 Protected Processor Inventory Number (R/O) 
See Table 2-2. 
Register Address: 79H, 121 IA32_BIOS_UPDT_TRIG 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
BIOS Update Trigger Register (W) Core 
See Table 2-2. 

Register Address: 8BH, 139 IA32_BlOS_SIGN_ID 
BIOS Update Signature ID (R/W) Thread 
See Table 2-2. 
Register Address: C1H, 193 IA32_PMCO 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: C2H, 194 IA32_PMC1 
Performance Counter Register Thread 
See Table 2-2. 
Register Address: CEH, 206 MSR_PLATFORM_INFO 
Platform Information Package 
Contains power management and other model specific features enumeration. See http://biosbits.org. 
7:0 Reserved. 
15:8 Maximum Non-Turbo Ratio (R/O) Package 
This is the ratio of the frequency that invariant TSC runs at. Frequency 
= ratio * 100 MHz. 
27:16 Reserved. 
28 Programmable Ratio Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that Programmable Ratio Limit for Turbo mode 
is enabled. When set to O, indicates Programmable Ratio Limit for Turbo 
mode is disabled. 
29 Programmable TDP Limit for Turbo Mode (R/O) Package 
When set to 1, indicates that TDP Limit for Turbo mode is 
programmable. When set to 0, indicates TDP Limit for Turbo mode is 
not programmable. 
39:30 Reserved. 
47:40 Maximum Efficiency Ratio (R/O) Package 
This is the minimum ratio (maximum efficiency) that the processor can 
operate, in units of 1O0MHz. 
63:48 Reserved. 
Register Address: E2H, 226 MSR_PKG_CST_CONFIG_CONTROL 
C-State Configuration Control (R/W) Package 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 


2:0 Package C-State Limit (R/W) 

Specifies the lowest C-state for the package. This feature does not limit 
the processor core C-state. The power-on default value from bit[2:0] of 
this register reports the deepest package C-state the processor is 
capable to support when manufactured. It is recommended that BIOS 
always read the power-on default value reported from this bit field to 
determine the supported deepest C-state on the processor and leave it 
as default without changing it. 

000b - CO/C1 (No package C-state support) 

001b - C2 

010b - C6 (non retention)* 

011b - C6 (Retention)* 

100b - Reserved 

101b - Reserved 

110b - Reserved 

111b - No package C-state limit. All C-States supported by the 
processor are available. 


Note: C6 retention mode provides more power saving than C6 non- 
retention mode. Limiting the package to C6 non retention mode does 
prevent the MSR_PKG_C6_RESIDENCY counter (MSR 3F9h) from being 


incremented. 
9:3 Reserved. 
10 1/0 MWAIT Redirection Enable (R/W) 


When set, will map IO_read instructions sent to IO registers at 
MSR_PMG_IO_CAPTURE_BASE[15:0] to MWAIT instructions. 


14:11 Reserved. 


15 CFG Lock (R/O) 


When set, locks bits [15:0] of this register for further writes until the 
next reset occurs. 


25 Reserved. 


26 C1 State Auto Demotion Enable (R/W) 


When set, the processor will conditionally demote C3/C6/C7 requests 
to C1 based on uncore auto-demote information. 


27 Reserved. 
28 C1 State Auto Undemotion Enable (R/W) 
When set, enables Undemotion from Demoted C1. 
29 PKG C-State Auto Demotion Enable (R/W) 
When set, enables Package C state demotion. 
63:30 Reserved. 
Register Address: E4H, 228 MSR_PMG_IO_CAPTURE_BASE 
Power Management IO Capture Base (R/W) Tile 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
15:0 LVL_2 Base Address (R/W) 
Microcode will compare |O-read zone to this base address to determine 
if an MWAIT(C2/3/4) needs to be issued instead of the |O-read. Should 
be programmed to the chipset Plevel_2 IO address. 
22:16 C-State Range (R/W) 
The l0-port block size in which l0-redirection will be executed (0-127). 
Should be programmed based on the number of LVLx registers existing 
in the chipset. 
63:23 Reserved. 
Register Address: E7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Thread 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
Memory Type Range Register (R) Core 
See Table 2-2. 
Register Address: 13CH, 316 MSR_FEATURE_CONFIG 
AES Configuration (RW-L) Core 
Privileged post-BIOS agent must provide a #GP handler to handle unsuccessful read of this MSR. 
1:0 AES Configuration (RW-L) 
Upon a successful read of this MSR, the configuration of AES 
instruction set availability is as follows: 
11b: AES instructions are not available until next RESET. 
Otherwise, AES instructions are available. 
Note, the AES instruction set is not available if read is unsuccessful. If 
the configuration is not 01b, AES instructions can be mis-configured if a 
privileged agent unintentionally writes 11b. 
63:2 Reserved. 
Register Address: 140H, 320 MISC_FEATURE_ENABLES 
MISC_FEATURE_ENABLES Thread 
0 Reserved. 
1 User Mode MONITOR and MWAIT (R/W) 
If set to 1, the MONITOR and MWAIT instructions do not cause invalid- 
opcode exceptions when executed with CPL > 0 or in virtual-8086 
mode. If MWAIT is executed when CPL > 0 or in virtual-8086 mode, and 
if EAX indicates a C-state other than CO or C1, the instruction operates 
as if EAX indicated the C-state C1. 
63:2 Reserved. 
Register Address: 174H, 372 IA32_SYSENTER_CS 
See Table 2-2. Thread 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 175H, 373 IA32_SYSENTER_ESP 
See Table 2-2. Thread 
Register Address: 176H, 374 IA32_SYSENTER_EIP 
See Table 2-2. Thread 
Register Address: 1 79H, 377 IA32_MCG_CAP 
See Table 2-2. Thread 
Register Address: 17AH, 378 IA32_MCG_STATUS 
See Table 2-2. Thread 
Register Address: 17DH, 381 MSR_SMM_MCA_CAP 
Enhanced SMM Capabilities (SMM-RO) Thread 
Reports SMM capability Enhancement. Accessible only while in SMM. 
31:0 Bank Support (SMM-RO) 
One bit per MCA bank. If the bit is set, that bank supports Enhanced 
MCA (Default all 0; does not support EMCA). 
55:32 Reserved. 
56 Targeted SMI (SMM-RO) 
Set if targeted SMI is supported. 
57 SMM_CPU_SVRSTR (SMM-RO) 
Set if SMM SRAM save/restore feature is supported. 
58 SMM_CODE_ACCESS_CHK (SMM-RO) 
Set if SMM code access check feature is supported. 
59 Long_Flow_Indication (SMM-RO) 
If set to 1, indicates that the SMM long flow indicator is supported and a 
host-space interface available to SMM handler. 
63:60 Reserved. 
Register Address: 186H, 390 IA32_PERFEVTSELO 
Performance Monitoring Event Select Register (R/w) Thread 
See Table 2-2. 
7:0 Event Select. 
15:8 UMask. 
16 USR. 
17 OS. 
18 Edge. 
19 PC. 
20 INT. 
21 AnyThread. 
22 EN. 
23 INV. 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
31:24 CMASK. 
63:32 Reserved. 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Thread 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. Package 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Thread 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 
Clock Modulation (R/W) Thread 
See Table 2-2. 
Register Address: 19BH, 411 IA32_THERM_INTERRUPT 
Thermal Interrupt Control (R/W) Module 
See Table 2-2. 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Module 
See Table 2-2. 
0 Thermal Status (R/O) 
1 Thermal Status Log (R/WCO) 
2 PROTCHOT # or FORCEPR# Status (R/O) 
3 PROTCHOT # or FORCEPR# Log (R/WCO) 
4 Critical Temperature Status (R/O) 
5 Critical Temperature Status Log (R/WCO) 
6 Thermal Threshold #1 Status (R/O) 
7 Thermal Threshold #1 Log (R/WCO) 
8 Thermal Threshold #2 Status (R/O) 
9 Thermal Threshold #2 Log (R/WCO) 
10 Power Limitation Status (R/O) 
11 Power Limitation Log (RWCO) 
15:12 Reserved. 
22:16 Digital Readout (R/O) 
26:23 Reserved. 
30:27 Resolution in Degrees Celsius (R/O) 
31 Reading Valid (R/O) 
63:32 Reserved. 
Register Address: 1AQH, 416 IA32_MISC_ENABLE 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Enable Misc. Processor Features (R/W) Thread 
Allows a variety of processor functions to be enabled and disabled. 
0 Fast-Strings Enable 
2:1 Reserved. 
3 Automatic Thermal Control Circuit Enable (R/W) 
6:4 Reserved. 
7 Performance Monitoring Available (R) 
10:8 Reserved. 
11 Branch Trace Storage Unavailable (R/O) 
12 Processor Event Based Sampling Unavailable (R/O) 
15:13 Reserved. 
16 Enhanced Intel SpeedStep Technology Enable (R/W) 
18 ENABLE MONITOR FSM (R/W) 
21:19 Reserved. 
22 Limit CPUID Maxval (R/W) 
23 xTPR Message Disable (R/W) 
33:24 Reserved. 
34 XD Bit Disable (R/W) 
See Table 2-3. 
37:35 Reserved. 
38 Turbo Mode Disable (R/W) 
63:39 Reserved. 
Register Address: 1A2H, 418 MSR_TEMPERATURE_TARGET 
Temperature Target Package 
15:0 Reserved. 
23:16 Temperature Target (R) 
29:24 Target Offset (R/W) 
63:30 Reserved. 
Register Address: 1A4H, 420 MSR_MISC_FEATURE_CONTROL 
Miscellaneous Feature Control (R/W) 
0 DCU Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L1 data cache prefetcher. 
1 L2 Hardware Prefetcher Disable (R/W) Core 
If 1, disables the L2 hardware prefetcher. 
63:2 Reserved. 
Register Address: 1A6H, 422 MSR_OFFCORE_RSP_O 
Offcore Response Event Select Register (R/W) Shared 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Scope 


Register Address: 1A7H, 423 


MSR_OFFCORE_RSP_1 


Offcore Response Event Select Register 


(R/W) 


Shared 


Register Address: 1ADH, 429 


MSR_TURBO_RATIO_LIMIT 


Maximum Ratio Limit of Turbo Mode for 


Groups of Cores (R/W) 


Package 


0 


Reserved. 


71 


Maximum Number of Cores in Group 0 


Number active processor cores which operates under the maximum 
ratio limit for group O. 


Package 


Maximum Ratio Limit for Group 0 


Maximum turbo ratio limit when the number of active cores are not 
more than the group O maximum core count. 


Package 


20:16 


Number of Incremental Cores Added to Group 1 

Group 1, which includes the specified number of additional cores plus 
the cores in group 0, operates under the group 1 turbo max ratio limit = 
“group O Max ratio limit” - “group ratio delta for group 1”. 


Package 


23:21 


28:24 


Group Ratio Delta for Group 1 

An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit to Group O. 

Number of Incremental Cores Added to Group 2 


Group 2, which includes the specified number of additional cores plus all 
the cores in group 1, operates under the group 2 turbo max ratio limit = 
“group 1 Max ratio limit” - “group ratio delta for group 2”. 


Package 


Package 


31:29 


Group Ratio Delta for Group 2 


An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit for Group 1. 


Package 


36:32 


39:37 


44:40 


Number of Incremental Cores Added to Group 3 


Group 3, which includes the specified number of additional cores plus all 
the cores in group 2, operates under the group 3 turbo max ratio limit = 
“group 2 Max ratio limit” - “group ratio delta for group 3”. 


Group Ratio Delta for Group 3 

An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit for Group 2. 

Number of Incremental Cores Added to Group 4 


Group 4, which includes the specified number of additional cores plus all 
the cores in group 3, operates under the group 4 turbo max ratio limit = 
“group 3 Max ratio limit” - “group ratio delta for group 4”. 


Package 


Package 


Package 


47:45 


Group Ratio Delta for Group 4 


An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit for Group 3. 


Package 


52:48 


Number of Incremental Cores Added to Group 5 

Group 5, which includes the specified number of additional cores plus all 
the cores in group 4, operates under the group 5 turbo max ratio limit = 
“group 4 Max ratio limit” - “group ratio delta for group 5”. 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
55:53 Group Ratio Delta for Group 5 Package 
An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit for Group 4. 
60:56 Number of Incremental Cores Added to Group 6 Package 
Group 6, which includes the specified number of additional cores plus all 
the cores in group 5, operates under the group 6 turbo max ratio limit = 
“group 5 Max ratio limit” - “group ratio delta for group 6”. 
63:61 Group Ratio Delta for Group 6 Package 
An unsigned integer specifying the ratio decrement relative to the Max 
ratio limit for Group 5. 
Register Address: 1BOH, 432 IA32_ENERGY_PERF_BIAS 
See Table 2-2. Thread 
Register Address: 1B1H, 433 IA32_PACKAGE_THERM_STATUS 
See Table 2-2. Package 
Register Address: 1B2H, 434 IA32_PACKAGE_THERM_INTERRUPT 
See Table 2-2. Package 
Register Address: 1C8H, 456 MSR_LBR_SELECT 
Last Branch Record Filtering Select Register (R/W) Thread 
See Section 18.9.2, “Filtering of Last Branch Records.” 
0 CPL_EQ_O 
1 CPL_NEQ_O 
2 JCC 
3 NEAR_REL_CALL 
4 NEAR_IND_CALL 
5 NEAR_RET 
6 NEAR_IND_JMP 
7 NEAR_REL_JMP 
8 FAR_BRANCH 
63:9 Reserved. 
Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/W) Thread 
Contains an index (bits 0-2) that points to the MSR containing the most recent branch record. 
See MSR_LASTBRANCH_O_FROM_IP. 


Register Address: 1D9H, 473 IA32_DEBUGCTL 
Debug Control (R/W) Thread 
0 LBR 


Setting this bit to 1 enables the processor to record a running trace of 
the most recent branches taken by the processor in the LBR stack. 
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DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
1 BTF 
Setting this bit to 1 enables the processor to treat EFLAGS.TF as single- 
step on branches instead of single-step on instructions. 
5:2 Reserved. 
6 TR 
Setting this bit to 1 enables branch trace messages to be sent. 
7 BTS 
Setting this bit enables branch trace messages (BTMs) to be logged in a 
BTS buffer. 
8 BTINT 
When clear, BTMs are logged in a BTS buffer in circular fashion. When 
this bit is set, an interrupt is generated by the BTS facility when the 
BTS buffer is full. 
9 BTS_OFF_OS 
When set, BTS or BTM is skipped if CPL = 0. 
10 BTS_OFF_USR 
When set, BTS or BTM is skipped if CPL > O. 
11 FREEZE_LBRS_ON_PMI 
When set, the LBR stack is frozen on a PMI request. 
12 FREEZE_PERFMON_ON_PMI 
When set, each ENABLE bit of the global counter control MSR are frozen 
(address 3BFH) on a PMI request. 
13 Reserved. 
14 FREEZE_WHILE_SMM 
When set, freezes perfmon and trace messages while in SMM. 
31:15 Reserved. 
Register Address: 1DDH, 477 MSR_LER_FROM_LIP 
Last Exception Record from Linear IP (R) Thread 
Register Address: 1DEH, 478 MSR_LER_TO_LIP 
Last Exception Record to Linear IP (R) Thread 


Register Address: 1F2H, 498 


IA32_SMRR_PHYSBASE 


See Table 2-2. Core 
Register Address: 1F3H, 499 IA32_SMRR_PHYSMASK 

See Table 2-2. Core 
Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

See Table 2-2. Core 
Register Address: 201H, 513 IA32_MTRR_PHYSMASKO 

See Table 2-2. Core 


Register Address: 202H, 514 


IA32_MTRR_PHYSBASE1 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
See Table 2-2. Core 
Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 
See Table 2-2. Core 
Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 
See Table 2-2. Core 
Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 
See Table 2-2. Core 
Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 
See Table 2-2. Core 
Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 
See Table 2-2. Core 
Register Address: 208H, 520 IA32_MTRR_PHYSBASE4 
See Table 2-2. Core 
Register Address: 209H, 521 IA32_MTRR_PHYSMASK4 
See Table 2-2. Core 
Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 
See Table 2-2. Core 
Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 
See Table 2-2. Core 
Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 
See Table 2-2. Core 
Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 
See Table 2-2. Core 
Register Address: 20€H, 526 IA32_MTRR_PHYSBASE7 
See Table 2-2. Core 
Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 
See Table 2-2. Core 
Register Address: 250H, 592 IA32_MTRR_FIX64K_00000 
See Table 2-2. Core 
Register Address: 258H, 600 IA32_MTRR_FIX16K_80000 
See Table 2-2. Core 
Register Address: 259H, 601 IA32_MTRR_FIX16K_A0000 
See Table 2-2. Core 
Register Address: 268H, 616 IA32_MTRR_FIX4K_CO000 
See Table 2-2. Core 
Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 
See Table 2-2. Core 
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DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 26AH, 618 IA32_MTRR_FIX4K_D0000 
See Table 2-2. Core 
Register Address: 26BH, 619 IA32_MTRR_FIX4K_D8000 
See Table 2-2. Core 
Register Address: 26CH, 620 IA32_MTRR_FIX4K_E0000 
See Table 2-2. Core 
Register Address: 26DH, 621 IA32_MTRR_FIX4K_E8000 
See Table 2-2. Core 
Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOO00 
See Table 2-2. Core 
Register Address: 26FH, 623 IA32_MTRR_FIX4K_F8000 
See Table 2-2. Core 
Register Address: 277H, 631 IA32_PAT 
See Table 2-2. Core 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Core 
See Table 2-2. 
Register Address: 309H, 777 IA32_FIXED_CTRO 
Fixed-Function Performance Counter Register O (R/W) Thread 
See Table 2-2. 
Register Address: 30AH, 778 IA32_FIXED_CTR1 
Fixed-Function Performance Counter Register 1 (R/W) Thread 
See Table 2-2. 
Register Address: 30BH, 779 IA32_FIXED_CTR2 
Fixed-Function Performance Counter Register 2 (R/W) Thread 
See Table 2-2. 
Register Address: 345H, 837 IA32_PERF_CAPABILITIES 
See Table 2-2. See Section 18.4.1, “IA32_DEBUGCTL MSR.” Package 
Register Address: 38DH, 909 IA32_FIXED_CTR_CTRL 
Fixed-Function-Counter Control Register (R/W) Thread 
See Table 2-2. 
Register Address: 38€H, 910 IA32_PERF_GLOBAL_STATUS 
See Table 2-2. Thread 
Register Address: 38FH, 911 IA32_PERF_GLOBAL_CTRL 
See Table 2-2. Thread 
Register Address: 390H, 912 IA32_PERF_GLOBAL_OVF_CTRL 
See Table 2-2. Thread 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
See Table 2-2. Thread 
Register Address: 3F8H, 1016 MSR_PKG_C3_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state Package 
parameters or ACPI C-states. 
63:0 Package C3 Residency Counter (R/O) 
Register Address: 3F9H, 1017 MSR_PKG_C6_RESIDENCY 
63:0 Package C6 Residency Counter (R/O) Package 
Register Address: 3FAH, 1018 MSR_PKG_C7_RESIDENCY 
63:0 Package C7 Residency Counter (R/O) Package 
Register Address: 3FCH, 1020 MSR_MCO_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state Module 
parameters or ACPI C-states. 
63:0 Module CO Residency Counter (R/O) 
Register Address: 3FDH, 1021 MSR_MC6_RESIDENCY 
63:0 Module C6 Residency Counter (R/O) Module 
Register Address: 3FFH, 1023 MSR_CORE_C6_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state Core 
parameters or ACPI C-states. 
63:0 CORE C6 Residency Counter (R/O) 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 401H, 1025 IA32_MCO_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Core 
Register Address: 402H, 1026 IA32_MCO_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Core 
Register Address: 404H, 1028 IA32_MC1_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 405H, 1029 IA32_MC1_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Core 
Register Address: 408H, 1032 IA32_MC2_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 409H, 1033 IA32_MC2_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Core 
Register Address: 40AH, 1034 IA32_MC2_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 40CH, 1036 IA32_MC3_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 40DH, 1037 IA32_MC3_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Core 
Register Address: 40€H, 1038 IA32_MC3_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
Register Address: 410H, 1040 IA32_MC4_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Core 
Register Address: 411H, 1041 IA32_MC4_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Core 
Register Address: 412H, 1042 IA32_MC4_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Core 
The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. 
When not implemented in the processor, all reads and writes to this MSR will cause a general-protection 
exception. 
Register Address: 414H, 1044 IA32_MC5_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Package 
Register Address: 415H, 1045 IA32_MC5_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Package 
Register Address: 416H, 1046 IA32_MC5_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." Package 
Register Address: 4C1H, 1217 IA32_A_PMCO 
See Table 2-2. Thread 
Register Address: 4C2H, 1218 IA32_A_PMC1 
See Table 2-2. Thread 
Register Address: 600H, 1536 IA32_DS_AREA 
DS Save Area (R/W) Thread 
See Table 2-2. 
Register Address: 606H, 1542 MSR_RAPL_POWER_UNIT 
Unit Multipliers Used in RAPL Interfaces (R/O) Package 
3:0 Power Units Package 
See Section 15.10.1, “RAPL Interfaces.” 
7:4 Reserved. Package 
12:8 Energy Status Units Package 
Energy related information (in Joules) is based on the multiplier, 
1/2°ESU; where ESU is an unsigned integer represented by bits 12:8. 
Default value is OEH (or 61 micro-joules). 
15:13 Reserved. Package 
19:16 Time Units Package 
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See Section 15.10.1, “RAPL Interfaces.” 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 


See Section 15.10.3, “Package RAPL Domain.” 


Register Information / Bit Fields Bit Description Scope 
63:20 Reserved. 
Register Address: G0DH, 1549 MSR_PKG_C2_RESIDENCY 
Note: C-state values are processor specific C-state code names, unrelated to MWAIT extension C-state Package 
parameters or ACPI C-states. 
63:0 Package C2 Residency Counter (R/O) 
Register Address: 610H, 1552 MSR_PKG_POWER_LIMIT 
PKG RAPL Power Limit Control (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 
Register Address: 611H, 1553 MSR_PKG_ENERGY_STATUS 
PKG Energy Status (R/O) Package 


PKG Perf Status (R/O) 
See Section 15.10.3, “Package RAPL Domain.” 


Register Address: 613H, 1555 MSR_PKG_PERF_STATUS 
Register Address: 614H, 1556 MSR_PKG_POWER_INFO 


Package 


See Section 15.10.5, “DRAM RAPL Domain." 


PKG RAPL Parameters (R/W) Package 
See Section 15.10.3, “Package RAPL Domain.” 

Register Address: 618H, 1560 MSR_DRAM_POWER_LIMIT 

DRAM RAPL Power Limit Control (R/W) Package 


Register Address: 619H, 1561 MSR_DRAM_ENERGY_STATUS 


See Table 2-25. 


DRAM Energy Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain." 

Register Address: 61BH, 1563 MSR_DRAM_PERF_STATUS 

DRAM Performance Throttling Status (R/O) Package 
See Section 15.10.5, “DRAM RAPL Domain." 

Register Address: 61CH, 1564 MSR_DRAM_POWER_INFO 

DRAM RAPL Parameters (R/W) Package 
See Section 15.10.5, “DRAM RAPL Domain." 

Register Address: 638H, 1592 MSR_PPO_POWER_LIMIT 

PPO RAPL Power Limit Control (R/W) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 

Register Address: 639H, 1593 MSR_PPO_ENERGY_STATUS 

PPO Energy Status (R/O) Package 
See Section 15.10.4, “PPO/PP1 RAPL Domains.” 

Register Address: 648H, 1608 MSR_CONFIG_TDP_NOMINAL 

Base TDP Ratio (R/O) Package 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 
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Register Information / Bit Fields Bit Description Scope 
Register Address: 649H, 1609 MSR_CONFIG_TDP_LEVEL1 
ConfigTDP Level 1 ratio and power level (R/O) Package 
See Table 2-25. 
Register Address: 64AH, 1610 MSR_CONFIG_TDP_LEVEL2 
ConfigTDP Level 2 ratio and power level (R/O) Package 
See Table 2-25. 
Register Address: 64BH, 1611 MSR_CONFIG_TDP_CONTROL 
ConfigTDP Control (R/W) Package 
See Table 2-25. 
Register Address: 64CH, 1612 MSR_TURBO_ACTIVATION_RATIO 
ConfigTDP Control (R/W) Package 
See Table 2-25. 
Register Address: 690H, 1680 MSR_CORE_PERF_LIMIT_REASONS 
Indicator of Frequency Clipping in Processor Cores (R/W) Package 
(Frequency refers to processor core frequency.) 
0 PROCHOT Status (RO) 
1 Thermal Status (RO) 
5:2 Reserved. 
6 VR Therm Alert Status (RO) 
7 Reserved. 
8 Electrical Design Point Status (RO) 
63:9 Reserved. 
Register Address: 6EOH, 1760 IA32_TSC_DEADLINE 
TSC Target of Local APIC’s TSC Deadline Mode (R/W) Core 
See Table 2-2. 
Register Address: 802H, 2050 IA32_X2APIC_APICID 
x2APIC ID Register (R/O) Thread 
Register Address: 803H, 2051 IA32_X2APIC_VERSION 
x2APIC Version Register (R/O) Thread 
Register Address: 808H, 2056 IA32_X2APIC_TPR 
X2APIC Task Priority Register (R/W) Thread 
Register Address: 80AH, 2058 IA32_X2APIC_PPR 
x2APIC Processor Priority Register (R/O) Thread 
Register Address: 80BH, 2059 IA32_X2APIC_EOI 
x2APIC EO! Register (W/O) Thread 
Register Address: 80DH, 2061 IA32_X2APIC_LDR 
x2APIC Logical Destination Register (R/O) Thread 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 

Register Address: 80FH, 2063 IA32_X2APIC_SIVR 

x2APIC Spurious Interrupt Vector Register (R/W) Thread 
Register Address: 810H, 2064 IA32_X2APIC_ISRO 

x2APIC In-Service Register Bits [31:0] (R/O) Thread 
Register Address: 811H, 2065 IA32_X2APIC_ISR1 

x2APIC In-Service Register Bits [63:32] (R/O) Thread 
Register Address: 812H, 2066 IA32_X2APIC_ISR2 

X2APIC In-Service Register Bits [95:64] (R/O) Thread 
Register Address: 813H, 2067 IA32_X2APIC_ISR3 

x2APIC In-Service Register Bits [127:96] (R/O) Thread 
Register Address: 814H, 2068 IA32_X2APIC_ISR4 

Xx2APIC In-Service Register Bits [159:128] (R/O) Thread 
Register Address: 815H, 2069 IA32_X2APIC_ISR5 

X2APIC In-Service Register Bits [191:160] (R/O) Thread 
Register Address: 816H, 2070 IA32_X2APIC_ISR6 

x2APIC In-Service Register Bits [223:192] (R/O) Thread 
Register Address: 817H, 2071 IA32_X2APIC_ISR7 

X2APIC In-Service Register Bits [255:224] (R/O) Thread 
Register Address: 818H, 2072 IA32_X2APIC_TMRO 

x2APIC Trigger Mode Register Bits [31:0] (R/O) Thread 
Register Address: 819H, 2073 IA32_X2APIC_TMR1 

x2APIC Trigger Mode Register Bits [63:32] (R/O) Thread 
Register Address: 81AH, 2074 IA32_X2APIC_TMR2 

x2APIC Trigger Mode Register Bits [95:64] (R/O) Thread 
Register Address: 81BH, 2075 IA32_X2APIC_TMR3 

x2APIC Trigger Mode Register Bits [127:96] (R/O) Thread 
Register Address: 81CH, 2076 IA32_X2APIC_TMR4 

x2APIC Trigger Mode Register Bits [159:128] (R/O) Thread 
Register Address: 81DH, 2077 IA32_X2APIC_TMR5 

x2APIC Trigger Mode Register Bits [191:160] (R/O) Thread 
Register Address: 81H, 2078 IA32_X2APIC_TMR6 

x2APIC Trigger Mode Register Bits [223:192] (R/O) Thread 
Register Address: 81FH, 2079 IA32_X2APIC_TMR7 

x2APIC Trigger Mode Register Bits [255:224] (R/O) Thread 
Register Address: 820H, 2080 IA32_X2APIC_IRRO 

x2APIC Interrupt Request Register Bits [31:0] (R/O) Thread 
Register Address: 821H, 2081 IA32_X2APIC_IRR1 
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Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 


DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal 


Register Name 
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Register Information / Bit Fields Bit Description Scope 
x2APIC Interrupt Request Register Bits [63:32] (R/O) Thread 
Register Address: 822H, 2082 IA32_X2APIC_IRR2 
x2APIC Interrupt Request Register Bits [95:64] (R/O) Thread 
Register Address: 823H, 2083 IA32_X2APIC_IRR3 
x2APIC Interrupt Request Register Bits [127:96] (R/O) Thread 
Register Address: 824H, 2084 IA32_X2APIC_IRR4 
x2APIC Interrupt Request Register Bits [159:128] (R/O) Thread 
Register Address: 825H, 2085 IA32_X2APIC_IRR5 
x2APIC Interrupt Request Register Bits [191:160] (R/O) Thread 
Register Address: 826H, 2086 IA32_X2APIC_IRR6 
x2APIC Interrupt Request Register Bits [223:192] (R/O) Thread 
Register Address: 827H, 2087 IA32_X2APIC_IRR7 
x2APIC Interrupt Request Register Bits [255:224] (R/O) Thread 
Register Address: 828H, 2088 IA32_X2APIC_ESR 
x2APIC Error Status Register (R/W) Thread 
Register Address: 82FH, 2095 IA32_X2APIC_LVT_CMCI 
x2APIC LVT Corrected Machine Check Interrupt Register (R/W) Thread 
Register Address: 830H, 2096 IA32_X2APIC_ICR 
X2APIC Interrupt Command Register (R/W) Thread 
Register Address: 832H, 2098 IA32_X2APIC_LVT_TIMER 
x2APIC LVT Timer Interrupt Register (R/W) Thread 
Register Address: 833H, 2099 IA32_X2APIC_LVT_THERMAL 
x2APIC LVT Thermal Sensor Interrupt Register (R/W) Thread 
Register Address: 834H, 2100 IA32_X2APIC_LVT_PMI 
x2APIC LVT Performance Monitor Register (R/W) Thread 
Register Address: 835H, 2101 1A32_X2APIC_LVT_LINTO 
x2APIC LVT LINTO Register (R/W) Thread 
Register Address: 836H, 2102 IA32_X2APIC_LVT_LINT1 
x2APIC LVT LINT1 Register (R/W) Thread 
Register Address: 837H, 2103 IA32_X2APIC_LVT_ERROR 
x2APIC LVT Error Register (R/W) Thread 
Register Address: 838H, 2104 1A32_X2APIC_INIT_COUNT 
X2APIC Initial Count Register (R/W) Thread 
Register Address: 839H, 2105 1A32_X2APIC_CUR_COUNT 
x2APIC Current Count Register (R/O) Thread 
Register Address: 83EH, 2110 1A32_X2APIC_DIV_CONF 
x2APIC Divide Configuration Register (R/W) Thread 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-56. Selected MSRs Supported by Intel® Xeon Phi™ Processors with a CPUID Signature 
DisplayFamily_DisplayModel Value of 06_57H or 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Scope 
Register Address: 83FH, 2111 IA32_X2APIC_SELF_IPI 
x2APIC Self IPI Register (W/O) Thread 
Register Address: COOO_OO080H IA32_EFER 


Extended Feature Enables Thread 
See Table 2-2. 


Register Address: COO0_0081H IA32_STAR 


System Call Target Address (R/W) Thread 
See Table 2-2. 


Register Address: COO0_0082H IA32_LSTAR 


IA-32e Mode System Call Target Address (R/W) Thread 
See Table 2-2. 


Register Address: COO0_0084H IA32_FMASK 


System Call Flag Mask (R/W) Thread 
See Table 2-2. 


Register Address: CO00_0100H IA32_FS_BASE 


Map of BASE Address of FS (R/W) Thread 
See Table 2-2. 


Register Address: CO00_0101H IA32_GS_BASE 
Map of BASE Address of GS (R/W) Thread 
See Table 2-2. 

Register Address: CO00_0102H IA32_KERNEL_GS_BASE 


Swap Target of BASE Address of GS (R/W) Thread 
See Table 2-2. 


Register Address: CO00_0103H IA32_TSC_AUX 


AUXILIARY TSC Signature (R/W) Thread 
See Table 2-2 


Table 2-57 lists model-specific registers that are supported by the Intel® Xeon Phi™ processor 7215, 7285, 7295 
series based on the Knights Mill microarchitecture. 


Table 2-57. Additional MSRs Supported by the Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 
with a CPUID Signature DisplayFamily_DisplayModel Value of 06_85H 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description Scope 
Register Address: 9BH, 155 IA32_SMM_MONITOR_CTL 
SMM Monitor Configuration (R/W) Core 
This MSR is readable only if VMX is enabled, and writeable only if VMX is enabled and in SMM mode, and is used to 
configure the VMX MSEG base address. See Table 2-2. 


Register Address: 480H, 1152 IA32_VMX_BASIC 
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Table 2-57. Additional MSRs Supported by the Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 
with a CPUID Signature DisplayFamily_DisplayModel Value of 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Reporting Register of Basic VMX Capabilities (R/O) Core 
See Table 2-2. 
Register Address: 481H, 1153 IA32_VMX_PINBASED_CTLS 
Capability Reporting Register of Pin-based VM-execution Controls (R/O) Core 
See Table 2-2. 
Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 
Capability Reporting Register of Primary Processor-based VM-execution Controls (R/O) Core 
Register Address: 483H, 1155 IA32_VWMX_EXIT_CTLS 
Capability Reporting Register of VM-exit Controls (R/O) Core 
See Table 2-2. 
Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 
Capability Reporting Register of VM-entry Controls (R/O) Core 
See Table 2-2. 
Register Address: 485H, 1157 IA32_VMX_MISC 
Reporting Register of Miscellaneous VMX Capabilities (R/O) Core 
See Table 2-2. 
Register Address: 486H, 1158 IA32_WMX_CRO_FIXEDO 
Capability Reporting Register of CRO Bits Fixed to 0 (R/O) Core 
See Table 2-2. 
Register Address: 487H, 1159 IA32_VWMX_CRO_FIXED1 
Capability Reporting Register of CRO Bits Fixed to 1 (R/O) Core 
See Table 2-2. 
Register Address: 488H, 1160 IA32_WMX_CR4_FIXEDO 
Capability Reporting Register of CR4 Bits Fixed to O (R/O) Core 
See Table 2-2. 
Register Address: 489H, 1161 IA32_VWMX_CR4_FIXED1 
Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) Core 
See Table 2-2. 
Register Address: 48AH, 1162 1A32_VMX_VMCS_ENUM 
Capability Reporting Register of VMCS Field Enumeration (R/O) Core 
See Table 2-2. 
Register Address: 48BH, 1163 IA32_VMX_PROCBASED_CTLS2 
Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) Core 
See Table 2-2. 
Register Address: 48CH, 1164 IA32_VMX_EPT_VPID_ENUM 
Capability Reporting Register of EPT and VPID (R/O) Core 
See Table 2-2. 
Register Address: 48DH, 1165 IA32_VMX_TRUE_PINBASED_CTLS 
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Table 2-57. Additional MSRs Supported by the Intel® Xeon Phi™ Processor 7215, 7285, 7295 Series 
with a CPUID Signature DisplayFamily_DisplayModel Value of 06_85H (Contd.) 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Scope 
Capability Reporting Register of Pin-Based VM-Execution Flex Controls (R/O) Core 
See Table 2-2. 
Register Address: 48EH, 1166 IA32_VMX_TRUE_PROCBASED_CTLS 
Capability Reporting Register of Primary Processor-Based VM-Execution Flex Controls (R/O) Core 
See Table 2-2. 
Register Address: 48FH, 1167 IA32_VMX_TRUE_EXIT_CTLS 
Capability Reporting Register of VM-Exit Flex Controls (R/O) Core 
See Table 2-2. 
Register Address: 490H, 1168 IA32_VMX_TRUE_ENTRY_CTLS 
Capability Reporting Register of VM-Entry Flex Controls (R/O) Core 
See Table 2-2. 
Register Address: 491H, 1169 IA32_WMX_FMFUNC 
Capability Reporting Register of VM-Function Controls (R/O) Core 
See Table 2-2. 


2.19 MSRSIN THE PENTIUM® 4 AND INTEL® XEON® PROCESSORS 


Table 2-58 lists MSRs (architectural and model-specific) that are defined across processor generations based on 

Intel NetBurst microarchitecture. The processor can be identified by its CPUID signatures of DisplayFamily 

encoding of OFH, see Table 2-1. 

¢ MSRs with an “IA32_” prefix are designated as “architectural.” This means that the functions of these MSRs and 
their addresses remain the same for succeeding families of IA-32 processors. 

¢ MSRs with an “MSR_” prefix are model specific with respect to address functionalities. The column “Model 
Availability” lists the model encoding value(s) within the Pentium 4 and Intel Xeon processor family at the 
specified register address. The model encoding value of a processor can be queried using CPUID. See 
“CPUID—CPU Identification” in Chapter 3 of the Intel® 64 and IA-32 Architectures Software Developer’s 
Manual, Volume 2A. 


Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description a ieata reaue! 
Register Address: OH, O IA32_P5_MC_ADDR 

See Section 2.23, "MSRs in Pentium Processors." 0, 1, 2, 3,4, 6 | Shared 
Register Address: 1H, 1 IA32_P5_MC_TYPE 

See Section 2.23, “MSRs in Pentium Processors.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 6H, 6 IA32_MONITOR_FILTER_LINE_SIZE 

See Section 9.10.5, “Monitor/Mwait Address Range Determination.” 3,4,6 Shared 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 

Time Stamp Counter 0, 1, 2, 3, 4,6 | Unique 
See Table 2-2. 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 
Register Address: Hex, Decimal Register Name 


Model Shared/ 


Register Information / Bit Fields Bit Description Availability Unique! 


On earlier processors, only the lower 32 bits are writable. On any write to the lower 32 bits, the upper 
32 bits are cleared. For processor family OFH, models 3 and 4: all 64 bits are writable. 

Register Address: 17H, 23 IA32_PLATFORM_ID 

Platform ID (R) 0, 1,2, 3,4, 6 | Shared 
See Table 2-2. 

The operating system can use this MSR to determine “slot” information for the processor and the 
proper microcode update to load. 

Register Address: 1BH, 27 IA32_APIC_BASE 


APIC Location and Status (R/W) 0, 1,2, 3, 4,6 | Unique 
See Table 2-2. See Section 11.4.4, “Local APIC Status and Location.” 


Register Address: 2AH, 42 MSR_EBC_HARD_POWERON 


Processor Hard Power-On Configuration 0, 1,2, 3, 4,6 | Shared 
(R/W) Enables and disables processor features. 
(R) Indicates current processor configuration. 


0 Output Tri-state Enabled (R) 


Indicates whether tri-state output is enabled (1) or disabled (0) as 
set by the strapping of SMI#. The value in this bit is written on 
the deassertion of RESET#; the bit is set to 1 when the address 
bus signal is asserted. 


1 Execute BIST (R) 


Indicates whether the execution of the BIST is enabled (1) or 
disabled (0) as set by the strapping of INIT#. The value in this bit 
is written on the deassertion of RESET#; the bit is set to 1 when 
the address bus signal is asserted. 


2 In Order Queue Depth (R) 


Indicates whether the in order queue depth for the system bus is 
1 (1) or up to 12 (0) as set by the strapping of A7#. The value in 
this bit is written on the deassertion of RESET#; the bit is set to 
1 when the address bus signal is asserted. 


3 MCERR# Observation Disabled (R) 


Indicates whether MCERR# observation is enabled (0) or disabled 
(1) as determined by the strapping of A9#. The value in this bit is 
written on the deassertion of RESET#; the bit is set to 1 when 
the address bus signal is asserted. 


4 BINIT# Observation Enabled (R) 


Indicates whether BINIT# observation is enabled (0) or disabled 
(1) as determined by the strapping of A10#. The value in this bit 
is written on the deassertion of RESET#; the bit is set to 1 when 
the address bus signal is asserted. 


6:5 APIC Cluster ID (R) 


Contains the logical APIC cluster ID value as set by the strapping 
of Al2# and A11#. The logical cluster ID value is written into the 
field on the deassertion of RESET#; the field is set to 1 when the 
address bus signal is asserted. 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal 


Register Name 


; : se pe F er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
7 Bus Park Disable (R) 
Indicates whether bus park is enabled (0) or disabled (1) as set by 
the strapping of A15#. The value in this bit is written on the 
deassertion of RESET#; the bit is set to 1 when the address bus 
signal is asserted. 

11:8 Reserved. 

13:12 Agent ID (R) 
Contains the logical agent ID value as set by the strapping of 
BR[3:0]. The logical ID value is written into the field on the 
deassertion of RESET#; the field is set to 1 when the address bus 
Signal is asserted. 

63:14 Reserved. 

Register Address: 2BH, 43 MSR_EBC_SOFT_POWERON 

Processor Soft Power-On Configuration (R/W) 0, 1, 2, 3,4, 6 | Shared 

Enables and disables processor features. 

0 RCNT/SCNT On Request Encoding Enable (R/W) 
Controls the driving of RCNT/SCNT on the request encoding. Set 
to enable (1); clear to disabled (0, default). 

1 Data Error Checking Disable (R/W) 
Set to disable system data bus parity checking; clear to enable 
parity checking. 

2 Response Error Checking Disable (R/W) 
Set to disable (default); clear to enable. 

3 Address/Request Error Checking Disable (R/W) 
Set to disable (default); clear to enable. 

4 Initiator MCERR# Disable (R/W) 
Set to disable MCERR# driving for initiator bus requests (default); 
clear to enable. 

5 Internal MCERR# Disable (R/W) 
Set to disable MCERR# driving for initiator internal errors 
(default); clear to enable. 

6 BINIT# Driver Disable (R/W) 
Set to disable BINIT# driver (default); clear to enable driver. 

63:7 Reserved. 

Register Address: 2CH, 44 MSR_EBC_FREQUENCY_ID 

Processor Frequency Configuration 2,3,4,6 Shared 


The bit field layout of this MSR varies according to the MODEL value in the CPUID version information. 
The following bit field layout applies to Pentium 4 and Xeon Processors with MODEL encoding equal or 


greater than 2. 
(R) The field Indicates the current pi 


rocessor frequency configuration. 


15:0 


Reserved. 
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Register Address: Hex, Decimal Register Name 

: : te : er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
18:16 Scalable Bus Speed (R/W) 


Indicates the intended scalable bus speed: 


EncodingScalable Bus Speed 
000B = 100 MHz (Model 2) 
Q00B 266 MHz (Model 3 or 4) 
001B 133MHz 

010B 200MHz 

011B 166MHz 

100B 333 MHz (Model 6) 


133.33 MHz should be utilized if performing calculation with 
System Bus Speed when encoding is 001B. 


166.67 MHz should be utilized if performing calculation with 
System Bus Speed when encoding is 011B. 


266.67 MHz should be utilized if performing calculation with 
System Bus Speed when encoding is OOOB and model encoding = 
3 or 4. 


333.33 MHz should be utilized if performing calculation with 
System Bus Speed when encoding is 100B and model encoding = 
6. 


All other values are reserved. 
23:19 Reserved. 


31:24 Core Clock Frequency to System Bus Frequency Ratio (R) 


The processor core clock frequency to system bus frequency 
ratio observed at the de-assertion of the reset pin. 


63:25 Reserved. 
Register Address: 2CH, 44 MSR_EBC_FREQUENCY_ID 
Processor Frequency Configuration (R) 0, 1 Shared 


The bit field layout of this MSR varies according to the MODEL value of the CPUID version information. 
This bit field layout applies to Pentium 4 and Xeon Processors with MODEL encoding less than 2. 


Indicates current processor frequency configuration. 

20:0 Reserved. 

23:21 Scalable Bus Speed (R/W) 

Indicates the intended scalable bus speed: 


Encoding Scalable Bus Speed 
000B 100MHz 


All others values reserved. 


63:24 Reserved. 

Register Address: 3AH, 58 IA32_FEATURE_CONTROL 

Control Features in IA-32 Processor (R/W) 3,4,6 Unique 
See Table 2-2. 

(If CPUID.O1H:ECX.[bit 5]) 


Register Address: 79H, 121 IA32_BlOS_UPDT_TRIG 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Pini ae nimi! 
BIOS Update Trigger Register (W) 0, 1, 2, 3, 4,6 | Shared 
See Table 2-2. 

Register Address: 8BH, 139 IA32_BIOS_SIGN_ID 

BIOS Update Signature ID (R/W) 0, 1, 2, 3, 4,6 | Unique 
See Table 2-2. 

Register Address: 9BH, 155 IA32_SMM_MONITOR_CTL 

SMM Monitor Configuration (R/W) 3,4,6 Unique 
See Table 2-2. 

Register Address: FEH, 254 IA32_MTRRCAP 

MTRR Information 0, 1, 2, 3, 4,6 | Unique 


See Section 12.11.1, “MTRR Feature Identification.” 


Register Address: 174H, 372 IA32_SYSENTER_CS 


CS Register Target for CPL O Code (R/W) 0, 1, 2, 3,4, 6 | Unique 
See Table 2-2 and Section 5.8.7, “Performing Fast Calls to System Procedures with the SYSENTER and 
SYSEXIT Instructions.” 

Register Address: 175H, 373 IA32_SYSENTER_ESP 


Stack Pointer for CPL O Stack (R/W) 0, 1,2, 3,4, 6 | Unique 


See Table 2-2 and Section 5.8.7, “Performing Fast Calls to System Procedures with the SYSENTER and 
SYSEXIT Instructions.” 


Register Address: 176H, 374 IA32_SYSENTER_EIP 


CPL O Code Entry Point (R/W) 0, 1,2, 3,4, 6 | Unique 


See Table 2-2 and Section 5.8.7, “Performing Fast Calls to System Procedures with the SYSENTER and 
SYSEXIT Instructions.” 


Register Address: 1 79H, 377 IA32_MCG_CAP 
Machine Check Capabilities (R) 0, 1, 2,3, 4,6 | Unique 
See Table 2-2 and Section 16.3.1.1, “IA32_MCG_CAP MSR.” 


Register Address: 17AH, 378 IA32_MCG_STATUS 


Machine Check Status (R) 0,1, 2,3, 4,6 | Unique 
See Table 2-2 and Section 16.3.1.2, “IA32_MCG_STATUS MSR.” 
Register Address: 17BH, 379 IA32_MCG_CTL 


Machine Check Feature Enable (R/W) 

See Table 2-2 and Section 16.3.1.3, “IA32_MCG_CTL MSR.” 
Register Address: 180H, 384 MSR_MCG_RAX 
Machine Check EAX/RAX Save State 0, 1, 2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 


63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 


Register Address: 181H, 385 MSR_MCG_RBX 
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Register Address: Hex, Decimal Register Name 


See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 


: : sae : er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
Machine Check EBX/RBX Save State 0, 1,2, 3,4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 

63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 182H, 386 MSR_MCG_RCX 
Machine Check ECX/RCX Save State 0, 1, 2, 3,4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 183H, 387 MSR_MCG_RDX 
Machine Check EDX/RDX Save State 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 184H, 388 MSR_MCG_RSI 
Machine Check ESI/RSI Save State 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 185H, 389 MSR_MCG_RDI 
Machine Check EDI/RDI Save State 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 186H, 390 MSR_MCG_RBP 
Machine Check EBP/RBP Save State 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 187H, 391 MSR_MCG_RSP 
Machine Check ESP/RSP Save State 0, 1, 2, 3, 4,6 | Unique 


63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 


contain valid data. 


MSR_MCG_RFLAGS 


Register Address: 188H, 392 
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Register Name 


; : ve pe F er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
Machine Check EFLAGS/RFLAG Save State 0, 1, 2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 

63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 189H, 393 MSR_MCG_RIP 
Machine Check EIP/RIP Save State 0, 1, 2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
63:0 Contains register state at time of machine check error. When in 
non-64-bit modes at the time of the error, bits 63-32 do not 
contain valid data. 
Register Address: 18AH, 394 MSR_MCG_MISC 
Machine Check Miscellaneous 0, 1, 2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
0 DS 
When set, the bit indicates that a page assist or page fault 
occurred during DS normal operation. The processors response is 
to shut down. 
The bit is used as an aid for debugging DS handling code. It is the 
responsibility of the user (BIOS or operating system) to clear this 
bit for normal operation. 
63:1 Reserved. 
Register Address: 18BH—18FH, MSR_MCG_RESERVED1—MSR_MCG_RESERVEDS 
395-399 
Reserved. 
Register Address: 190H, 400 MSR_MCG_R8 
Machine Check R8 0, 1, 2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 191H, 401 MSR_MCG_R9 
Machine Check R9D/R9 0, 1, 2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 192H, 402 MSR_MCG_R10 
Machine Check R10 0, 1, 2, 3, 4,6 | Unique 


See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 


Vol.4 2-459 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal 


Register Name 


: ; Sg ce . a Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 

in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 193H, 403 MSR_MCG_R11 
Machine Check R11 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 194H, 404 MSR_MCG_R12 
Machine Check R12 0, 1,2, 3,4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 195H, 405 MSR_MCG_R13 
Machine Check R13 0, 1,2, 3, 4,6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 196H, 406 MSR_MCG_R14 
Machine Check R14 0, 1,2, 3,4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs.” 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 197H, 407 MSR_MCG_R15 
Machine Check R15 0, 1,2, 3, 4, 6 | Unique 
See Section 16.3.2.6, “IA32_MCG Extended Machine Check State MSRs." 
63:0 Registers R8-15 (and the associated state-save MSRs) exist only 
in Intel 64 processors. These registers contain valid information 
only when the processor is operating in 64-bit mode at the time 
of the error. 
Register Address: 198H, 408 IA32_PERF_STATUS 
See Table 2-2. See Section 15.1, “Enhanced Intel Speedstep® Technology.” 3,4,6 Unique 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. See Section 15.1, “Enhanced Intel Speedstep® Technology.” 3,4,6 Unique 
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Register Information / Bit Fields Bit Description Pein ial 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 

Thermal Monitor Control (R/W) 0, 1,2, 3,4, 6 | Unique 
See Table 2-2 and Section 15.8.3, “Software Controlled Clock Modulation.” 

Register Address: 19BH, 411 IA32_THERM_INTERRUPT 

Thermal Interrupt Control (R/W) 0, 1,2, 3,4, 6 | Unique 
See Section 15.8.2, “Thermal Monitor,” and Table 2-2. 

Register Address: 19CH, 412 IA32_THERM_STATUS 

Thermal Monitor Status (R/W) 0, 1,2, 3,4,6 | Shared 
See Section 15.8.2, “Thermal Monitor,” and Table 2-2. 


Register Address: 19DH, 413 MSR_THERM2_CTL 


Thermal Monitor 2 Control 


For Family F, Model 3 processors: When read, specifies the value of the target TM2 transition last 3 Shared 
written. When set, it sets the next target value for TM2 transition. 

For Family F, Model 4 and Model 6 processors: When read, specifies the value of the target TM2 4,6 Shared 
transition last written. Writes may cause #GP exceptions. 

Register Address: 1AQH, 416 IA32_MISC_ENABLE 

Enable Miscellaneous Processor Features (R/W) 0, 1,2, 3,4,6 | Shared 
0 Fast-Strings Enable. See Table 2-2. 

1 Reserved. 

Ya x87 FPU Fopcode Compatibility Mode Enable 

3 Thermal Monitor 1 Enable 


See Section 15.8.2, “Thermal Monitor,” and Table 2-2. 


4 Split-Lock Disable 


When set, the bit causes an #AC exception to be issued instead 
of a split-lock cycle. Operating systems that set this bit must align 
system structures to avoid split-lock scenarios. 

When the bit is clear (default), normal split-locks are issued to the 
bus. 


This debug feature is specific to the Pentium 4 processor. 


5 Reserved. 


6 Third-Level Cache Disable (R/W) 


When set, the third-level cache is disabled; when clear (default) 
the third-level cache is enabled. This flag is reserved for 
processors that do not have a third-level cache. 


Note that the bit controls only the third-level cache; and only if 
overall caching is enabled through the CD flag of control register 
CRO, the page-level cache controls, and/or the MTRRs. 


See Section 12.5.4, “Disabling and Enabling the L3 Cache.” 
7 Performance Monitoring Available (R) 
See Table 2-2. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Model 
Availability 


Shared/ 
Unique! 


8 


Suppress Lock Enable 


When set, assertion of LOCK on the bus is suppressed during a 
Split Lock access. When clear (default), LOCK is not suppressed. 


Prefetch Queue Disable 


When set, disables the prefetch queue. When clear (default), 
enables the prefetch queue. 


FERR# Interrupt Reporting Enable (R/W) 


When set, interrupt reporting through the FERR# pin is enabled; 
when clear, this interrupt reporting function is disabled. 


When this flag is set and the processor is in the stop-clock state 
(STPCLK# is asserted), asserting the FERR# pin signals to the 
processor that an interrupt (such as, INIT#, BINIT#, INTR, NMI, 
SMI#, or RESET#) is pending and that the processor should return 
to normal operation to handle the interrupt. 

This flag does not affect the normal operation of the FERR# pin 
(to indicate an unmasked floating-point error) when the STPCLK# 
pin is not asserted. 


Branch Trace Storage Unavailable (BTS_UNAVILABLE) (R) 
See Table 2-2. 


When set, the processor does not support branch trace storage 
(BTS); when clear, BTS is supported. 


PEBS_UNAVILABLE: Processor Event Based Sampling Unavailable 
(R) 
See Table 2-2. 


When set, the processor does not support processor event-based 
sampling (PEBS); when clear, PEBS is supported. 


TM2 Enable (R/W) 


When this bit is set (1) and the thermal sensor indicates that the 
die temperature is at the pre-determined threshold, the Thermal 
Monitor 2 mechanism is engaged. TM2 will reduce the bus to core 
ratio and voltage according to the value last written to 
MSR_THERM2_CTL bits 15:0. 


When this bit is clear (0, default), the processor does not change 
the VID signals or the bus to core ratio when the processor 
enters a thermal managed state. 


If the TM2 feature flag (ECX[8]) is not set to 1 after executing 
CPUID with EAX = 1, then this feature is not supported and BIOS 
must not alter the contents of this bit location. The processor is 
operating out of spec if both this bit and the TM1 bit are set to 
disabled states. 


17:14 


Reserved. 


18 


ENABLE MONITOR FSM (R/W) 
See Table 2-2. 


3,4,6 
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5 : ve pi F ee Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
19 Adjacent Cache Line Prefetch Disable (R/W) 


When set to 1, the processor fetches the cache line of the 128- 
byte sector containing currently required data. When set to O, the 
processor fetches both cache lines in the sector. 


Single processor platforms should not set this bit. Server 
platforms should set or clear this bit based on platform 
performance observed in validation and testing. 


BIOS may contain a setup option that controls the setting of this 


bit. 

21:20 Reserved. 

22 Limit CPUID MAXVAL (R/W) 3,4,6 
See Table 2-2. 


Setting this can cause unexpected behavior to software that 
depends on the availability of CPUID leaves greater than 3. 


23 XTPR Message Disable (R/W) Shared 
See Table 2-2. 
24 L1 Data Cache Context Mode (R/W) 


When set, the L1 data cache is placed in shared mode; when clear 
(default), the cache is placed in adaptive mode. This bit is only 
enabled for IA-32 processors that support Intel Hyper-Threading 
Technology. See Section 12.5.6, "L1 Data Cache Context Mode.” 


When L1 is running in adaptive mode and CR3s are identical, data 
in L1 is shared across logical processors. Otherwise, L1 is not 
shared and cache use is competitive. 


If the Context ID feature flag (ECX[10]) is set to O after executing 


CPUID with EAX = 1, the ability to switch modes is not supported. 
BIOS must not alter the contents of [A32_MISC_ENABLE[24]. 


33:25 Reserved. 

34 XD Bit Disable (R/W) Unique 
See Table 2-3. 

63:35 Reserved. 

Register Address: 1A1H, 417 MSR_PLATFORM_BRV 

Platform Feature Requirements (R) 3,4,6 Shared 

17:0 Reserved. 

18 PLATFORM Requirements 


When set to 1, indicates the processor has specific platform 
requirements. The details of the platform requirements are listed 
in the respective data sheets of the processor. 


63:19 Reserved. 


Register Address: 1D7H, 471 MSR_LER_FROM_LIP 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description Peat ty ee 
Last Exception Record From Linear IP (R) 0, 1, 2, 3, 4, 6 | Unique 
Contains a pointer to the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 
See Section 18.13.3, “Last Exception Records.” 
31:0 From Linear IP 
Linear address of the last branch instruction. 
63:32 Reserved. 
Register Address: 1D7H, 471 MSR_LER_FROM_LIP 
63:0 From Linear IP Unique 
Linear address of the last branch instruction (If [A-32e mode is 
active). 
Register Address: 1D8H, 472 MSR_LER_TO_LIP 
Last Exception Record To Linear IP (R) 0, 1,2, 3,4, 6 | Unique 
This area contains a pointer to the target of the last branch instruction that the processor executed 
prior to the last exception that was generated or the last interrupt that was handled. 
See Section 18.13.3, “Last Exception Records.” 
31:0 From Linear IP 
Linear address of the target of the last branch instruction. 
63:32 Reserved. 
Register Address: 1D8H, 472 MSR_LER_TO_LIP 
63:0 From Linear IP Unique 
Linear address of the target of the last branch instruction (If IA- 
32e mode is active). 
Register Address: 1D9H, 473 MSR_DEBUGCTLA 
Debug Control (R/W) 0, 1,2, 3,4, 6 | Unique 
Controls how several debug features are used. Bit definitions are discussed in the referenced section. 
See Section 18.13.1, “MSR_DEBUGCTLA MSR.” 
Register Address: 1DAH, 474 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/O) 0, 1,2, 3,4, 6 | Unique 


Contains an index (0-3 or 0-15) that points to the top of the last branch record stack (that is, that 
points the index of the MSR containing the most recent branch record). 

See Section 18.13.2, “LBR Stack for Processors Based on Intel NetBurst® Microarchitecture,” and 
addresses 1DBH-1DEH and 680H-68FH. 


Last Branch Record 0 (R/O) 

One of four last branch record registers on the last branch record stack. It contains pointers to the 
source and destination instruction for one of the last four branches, exceptions, or interrupts that the 
processor took. 

MSR_LASTBRANCH_O through MSR_LLASTBRANCH_3 at 1DBH-1DEH are available only on family OFH, 
models OH-O2H. They have been replaced by the MSRs at 680H-68FH and 6COH-6CFH. 

See Section 18.12, “Last Branch, Call Stack, Interrupt, and Exception Recording for Processors based 
on Skylake Microarchitecture.” 


0,1,2 


Register Address: 1DBH, 475 MSR_LASTBRANCH_O 


Unique 
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Register Name 


Register Information / Bit Fields Bit Description Pein ial 
Register Address: 1DCH, 476 MSR_LASTBRANCH_1 

Last Branch Record 1 0, 1,2 Unique 
See description of the MSR_LASTBRANCH_O MSR at 1DBH. 

Register Address: 1DDH, 477 MSR_LASTBRANCH_2 

Last Branch Record 2 0,1,2 Unique 
See description of the MSR_LASTBRANCH_O MSR at 1DBH. 

Register Address: 1DEH, 478 MSR_LASTBRANCH_3 

Last Branch Record 3 0,1,2 Unique 
See description of the MSR_LASTBRANCH_O MSR at 1DBH. 

Register Address: 200H, 512 IA32_MTRR_PHYSBASEO 

Variable Range Base MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 201H, 513 IA32_MTRR_PHYSMASKO 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 202H, 514 IA32_MTRR_PHYSBASE1 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 203H, 515 IA32_MTRR_PHYSMASK1 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 204H, 516 IA32_MTRR_PHYSBASE2 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 205H, 517 IA32_MTRR_PHYSMASK2 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs". 

Register Address: 206H, 518 IA32_MTRR_PHYSBASE3 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 207H, 519 IA32_MTRR_PHYSMASK3 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 208H, 520 IA32_MTRR_PHYSBASE4. 

Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 


Register Address: 209H, 521 


IA32_MTRR_PHYSMASK4 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description Peat ty ane! 
Variable Range Mask MTRR 0, 1,2, 3,4, 6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 20AH, 522 IA32_MTRR_PHYSBASE5 

Variable Range Mask MTRR 0, 1,2, 3,4, 6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 20BH, 523 IA32_MTRR_PHYSMASK5 

Variable Range Mask MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 20CH, 524 IA32_MTRR_PHYSBASE6 

Variable Range Mask MTRR 0, 1,2, 3,4, 6 | Shared 


See Section 12.11.2.3, “Variable Range MTRRs.” 


Register Address: 20DH, 525 IA32_MTRR_PHYSMASK6 


Variable Range Mask MTRR 0, 1, 2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 


Register Address: 20EH, 526 IA32_MTRR_PHYSBASE7 


Variable Range Mask MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.3, “Variable Range MTRRs.” 

Register Address: 20FH, 527 IA32_MTRR_PHYSMASK7 

Variable Range Mask MTRR 0, 1,2, 3,4, 6 | Shared 


See Section 12.11.2.3, “Variable Range MTRRs.” 


Register Address: 250H, 592 IA32_MTRR_FIX64K_O0000 


Fixed Range MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.2, “Fixed Range MTRRs.” 

Register Address: 258H, 600 IA32_MTRR_FIX16K_80000 

Fixed Range MTRR 0, 1,2, 3,4, 6 | Shared 
See Section 12.11.2.2, “Fixed Range MTRRs.” 

Register Address: 259H, 601 IA32_MTRR_FIX16K_A0000 

Fixed Range MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.2, “Fixed Range MTRRs.” 

Register Address: 268H, 616 IA32_MTRR_FIX4K_CO000 

Fixed Range MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.2, “Fixed Range MTRRs.” 

Register Address: 269H, 617 IA32_MTRR_FIX4K_C8000 

Fixed Range MTRR 0, 1,2, 3, 4,6 | Shared 
See Section 12.11.2.2, “Fixed Range MTRRs”. 

Register Address: 26AH, 618 IA32_MTRR_FIX4K_DO000 

Fixed Range MTRR 0, 1,2, 3,4, 6 | Shared 


See Section 12.11.2.2, “Fixed Range MTRRs”. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Shared/ 
Unique! 


Model 
Availability 


Register Address: 26BH, 619 


IA32_MTRR_FIX4K_D8000 


Fixed Range MTRR 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


0, 1, 2, 3, 4,6 | Shared 


Register Address: 26CH, 620 


IA32_MTRR_FIX4K_E0000 


Fixed Range MTRR 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


0, 1, 2, 3, 4,6 | Shared 


Register Address: 26DH, 621 


IA32_MTRR_FIX4K_E8000 


Fixed Range MTRR 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


0, 1, 2, 3,4, 6 | Shared 


Fixed Range MTRR 


Register Address: 26FH, 623 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


IA32_MTRR_FIX4K_F8000 


Register Address: 26€H, 622 IA32_MTRR_FIX4K_FOOOO 


0, 1, 2, 3, 4,6 | Shared 


Fixed Range MTRR 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


0, 1, 2, 3, 4,6 | Shared 


Register Address: 277H, 631 


IA32_PAT 


Page Attribute Table 


See Section 12.11.2.2, “Fixed Range MTRRs.” 


0, 1,2, 3,4, 6 | Unique 


Register Address: 2FFH, 767 
Default Memory Types (R/W) 


Register Address: 300H, 768 


IA32_MTRR_DEF_TYPE 


See Table 2-2 and Section 12.11.2.1, “IA32_MTRR_DEF_TYPE MSR.” 


MSR_BPU_COUNTERO 


0, 1, 2, 3, 4,6 | Shared 


See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 301H, 769 MSR_BPU_COUNTER1 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 302H, 770 MSR_BPU_COUNTER2 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 303H, 771 MSR_BPU_COUNTER3 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 304H, 772 MSR_MS_COUNTERO 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 305H, 773 MSR_MS_COUNTER1 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 306H, 774 MSR_MS_COUNTER2 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 307H, 775 MSR_MS_COUNTER3 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 


Register Address: 308H, 776 


MSR_FLAME_COUNTERO 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Peet ty ane 
See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 309H, 777 MSR_FLAME_COUNTER1 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 30AH, 778 MSR_FLAME_COUNTER2 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 30BH, 779 MSR_FLAME_COUNTER3 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 30CH, 780 MSR_IQ_COUNTERO 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 30DH, 781 MSR_IQ_COUNTER1 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 30EH, 782 MSR_IQ_COUNTER2 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 30FH, 783 MSR_IQ_COUNTER3 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 310H, 784 MSR_IQ_COUNTER4 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 311H, 785 MSR_IQ_COUNTERS 

See Section 20.6.3.2, “Performance Counters.” 0, 1,2, 3, 4,6 | Shared 
Register Address: 360H, 864 MSR_BPU_CCCRO 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 361H, 865 MSR_BPU_CCCR1 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 362H, 866 MSR_BPU_CCCR2 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 363H, 867 MSR_BPU_CCCR3 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 364H, 868 MSR_MS_CCCRO 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 365H, 869 MSR_MS_CCCR1 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 366H, 870 MSR_MS_CCCR2 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 367H, 871 MSR_MS_CCCR3 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 368H, 872 MSR_FLAME_CCCRO 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Pein oe ial 
Register Address: 369H, 873 MSR_FLAME_CCCR1 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36AH, 874 MSR_FLAME_CCCR2 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36BH, 875 MSR_FLAME_CCCR3 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36CH, 876 MSR_IQ_CCCRO 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36DH, 877 MSR_IQ_CCCR1 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36€H, 878 MSR_IQ_CCCR2 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 36FH, 879 MSR_IQ_CCCR3 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 370H, 880 MSR_IQ_CCCR4 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 371H, 881 MSR_IQ_CCCR5 

See Section 20.6.3.3, “CCCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A0H, 928 MSR_BSU_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A1H, 929 MSR_BSU_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A2H, 930 MSR_FSB_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A3H, 931 MSR_FSB_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A4H, 932 MSR_FIRM_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A5H, 933 MSR_FIRM_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A6H, 934 MSR_FLAME_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A7H, 935 MSR_FLAME_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3A8H, 936 MSR_DAC_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 


Register Address: 3A9H, 937 


MSR_DAC_ESCR1 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Peeit ty ane 
See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3AAH, 938 MSR_MOB_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3ABH, 939 MSR_MOB_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3ACH, 940 MSR_PMH_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3ADH, 941 MSR_PMH_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3AEH, 942 MSR_SAAT_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3AFH, 943 MSR_SAAT_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3BOH, 944 MSR_U2L_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B1H, 945 MSR_U2L_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B2H, 946 MSR_BPU_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B3H, 947 MSR_BPU_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B4H, 948 MSR_IS_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B5H, 949 MSR_IS_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B6H, 950 MSR_ITLB_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B7H, 951 MSR_ITLB_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B8H, 952 MSR_CRU_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3B9H, 953 MSR_CRU_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3BAH, 954 MSR_IQ_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0,1,2 Shared 


This MSR is not available on later processors. It is only available on processor family OFH, models 01H- 


02H. 
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Register Name 
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Register Address: 3BBH, 955 MSR_IQ_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0,1,2 Shared 
This MSR is not available on later processors. It is only available on processor family OFH, models 01H- 

02H. 

Register Address: 3BCH, 956 MSR_RAT_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3BDH, 957 MSR_RAT_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3BEH, 958 MSR_SSU_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3COH, 960 MSR_MS_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C1H, 961 MSR_MS_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C2H, 962 MSR_TBPU_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3C3H, 963 MSR_TBPU_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C4H, 964 MSR_TC_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C5H, 965 MSR_TC_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C8H, 968 MSR_IX_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3C9SH, 969 MSR_IX_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3CAH, 970 MSR_ALF_ESCRO 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3CBH, 971 MSR_ALF_ESCR1 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3CCH, 972 MSR_CRU_ESCR2 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3CDH, 973 MSR_CRU_ESCR3 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 3E0H, 992 MSR_CRU_ESCR4 

See Section 20.6.3.1, “ESCR MSRs.” 0, 1,2, 3,4, 6 | Shared 


Register Address: 3E1H, 993 


MSR_CRU_ESCR5 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Peeit ty ane 
See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3FOH, 1008 MSR_TC_PRECISE_EVENT 
See Section 20.6.3.1, “ESCR MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 3F1H, 1009 IA32_PEBS_ENABLE (MSR_PEBS_ENABLE) 
Processor Event Based Sampling (PEBS) (R/W) 0, 1,2, 3,4, 6 | Shared 
Controls the enabling of processor event sampling and replay tagging. 
12:0 See https://perfmon-events.intel.com/. 
23:13 Reserved. 
24 UOP Tag 

Enables replay tagging when set. 
25 ENABLE_PEBS_MY_THR (R/W) 

Enables PEBS for the target logical processor when set; disables 

PEBS when clear (default). 

See Section 20.6.4.3, “IA32_PEBS_ENABLE MSR,” for an 

explanation of the target logical processor. 

This bit is called ENABLE_PEBS in IA-32 processors that do not 

support Intel Hyper-Threading Technology. 
26 ENABLE_PEBS_OTH_THR (R/W) 

Enables PEBS for the target logical processor when set; disables 

PEBS when clear (default). 

See Section 20.6.4.3, “IA32_PEBS_ENABLE MSR,” for an 

explanation of the target logical processor. 

This bit is reserved for IA-32 processors that do not support Intel 

Hyper-Threading Technology. 
63:27 Reserved. 
Register Address: 3F2H, 1010 MSR_PEBS_MATRIX_VERT 
See https://perfmon-events.intel.com/. 0, 1,2, 3, 4,6 | Shared 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 401H, 1025 IA32_MCO_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 402H, 1026 IA32_MCO_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 0, 1, 2, 3,4, 6 | Shared 


protection exception. 


The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in 
the IA32_MCO_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 


Register Address: 403H, 1027 


IA32_MCO_MISC 


2-472 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal Register Name 

5 : ae : ee Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 0, 1, 2, 3,4, 6 | Shared 


The IA32_MCO_MISC MSR is either not implemented or does not contain additional information if the 
MISCV flag in the [A32_MCO_STATUS register is clear. 

When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 404H, 1028 IA32_MC1_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 405H, 1029 IA32_MC1_STATUS 

See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 406H, 1030 IA32_MC1_ADDR 

See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 0, 1, 2, 3, 4,6 | Shared 


The IA32_MC1_ADDR register is either not implemented or contains no address if the ADDRV flag in 
the [A32_MC1_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 407H, 1031 IA32_MC1_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” Shared 


The IA32_MC1_MISC MSR is either not implemented or does not contain additional information if the 
MISCV flag in the IA32_MC1_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 408H, 1032 IA32_MC2_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 0, 1, 2, 3,4, 6 | Shared 
Register Address: 409H, 1033 IA32_MC2_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 0, 1, 2, 3,4, 6 | Shared 


Register Address: 40AH, 1034 IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in 
the [A32_MC2_STATUS register is clear. When not implemented in the processor, all reads and writes 
to this MSR will cause a general-protection exception. 


Register Address: 40BH, 1035 IA32_MC2_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


The IA32_MC2_MISC MSR is either not implemented or does not contain additional information if the 
MISCV flag in the IA32_MC2_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 40CH, 1036 IA32_MC3_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 0, 1,2, 3,4, 6 | Shared 
Register Address: 40DH, 1037 IA32_MC3_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 0, 1,2, 3,4, 6 | Shared 


Register Address: 40EH, 1038 IA32_MC3_ADDR 
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Register Address: Hex, Decimal Register Name 

: : soa : er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 0, 1, 2, 3,4, 6 | Shared 


The IA32_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in 
the IA32_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 40FH, 1039 IA32_MC3_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 0, 1,2, 3, 4,6 | Shared 


The IA32_MC3_MISC MSR is either not implemented or does not contain additional information if the 
MISCV flag in the IA32_MC3_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 410H, 1040 IA32_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 0, 1, 2, 3, 4,6 | Shared 
Register Address: 411H, 1041 IA32_MC4_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 0, 1,2, 3, 4,6 | Shared 


Register Address: 412H, 1042 IA32_MC4_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in 
the IA32_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 413H, 1043 IA32_MC4_MISC 


See Section 16.3.2.4, “IA32_MCi_MISC MSRs.” 


The IA32_MC2_MISC MSR is either not implemented or does not contain additional information if the 
MISCV flag in the |A32_MC4_STATUS register is clear. 


When not implemented in the processor, all reads and writes to this MSR will cause a general- 
protection exception. 


Register Address: 480H, 1152 IA32_VMX_BASIC 
Reporting Register of Basic VMX Capabilities (R/O) 3,4,6 Unique 
See Table 2-2 and Appendix A.1, “Basic VMX Information.” 

Register Address: 481H, 1153 IA32_VMX_PINBASED_CTLS 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) 3,4,6 Unique 
See Table 2-2 and Appendix A.3, “VM-Execution Controls.” 


Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) 3,4,6 Unique 
See Appendix A.3, “VM-Execution Controls,” and Table 2-2. 
Register Address: 483H, 1155 IA32_VMX_EXIT_CTLS 
Capability Reporting Register of VM-Exit Controls (R/O) 3,4,6 Unique 
See Appendix A.4, “VM-Exit Controls,” and Table 2-2. 

Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal Register Name 

; : ve pe F ee Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
Capability Reporting Register of VM-Entry Controls (R/O) 3,4,6 Unique 


See Appendix A.5, “VM-Entry Controls,” and Table 2-2. 
Register Address: 485H, 1157 IA32_VMX_MISC 
Reporting Register of Miscellaneous VMX Capabilities (R/O) 3,4,6 Unique 
See Appendix A.6, “Miscellaneous Data,” and Table 2-2. 
Register Address: 486H, 1158 IA32_VMX_CRO_FIXEDO 
Capability Reporting Register of CRO Bits Fixed to O (R/O) 3,4,6 Unique 
See Appendix A.7, “VMX-Fixed Bits in CRO,” and Table 2-2. 
Register Address: 487H, 1159 IA32_VMX_CRO_FIXED1 
Capability Reporting Register of CRO Bits Fixed to 1 (R/O) 3,4,6 Unique 
See Appendix A.7, “VMX-Fixed Bits in CRO,” and Table 2-2. 


Register Address: 488H, 1160 IA32_VMX_CR4_FIXEDO 


Capability Reporting Register of CR4 Bits Fixed to 0 (R/O) 3,4,6 Unique 
See Appendix A.8, “VMX-Fixed Bits in CR4,” and Table 2-2. 


Register Address: 489H, 1161 IA32_WMX_CR4_FIXED1 


Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) 3,4,6 Unique 
See Appendix A.8, “VMX-Fixed Bits in CR4,” and Table 2-2. 


Register Address: 48AH, 1162 IA32_VMX_VMCS_ENUM 


Capability Reporting Register of VMCS Field Enumeration (R/O) 3,4,6 Unique 
See Appendix A.9, “VMCS Enumeration,” and Table 2-2. 


Register Address: 48BH, 1163 IA32_WMX_PROCBASED_CTLS2 


Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) 3,4,6 Unique 
See Appendix A.3, “VM-Execution Controls,” and Table 2-2. 


Register Address: 600H, 1536 IA32_DS_AREA 
DS Save Area (R/W) 0, 1,2, 3,4, 6 | Unique 
See Table 2-2 and Section 20.6.3.4, “Debug Store (DS) Mechanism." 

Register Address: 680H, 1664 MSR_LASTBRANCH_O_FROM_IP 


Last Branch Record 0 (R/W) 3,4,6 Unique 


One of 16 pairs of last branch record registers on the last branch record stack (680H-68FH). This part 
of the stack contains pointers to the source instruction for one of the last 16 branches, exceptions, or 
interrupts taken by the processor. 


The MSRs at 680H-68FH, 6COH-6CHH are not available in processor releases before family OFH, model 
03H. These MSRs replace MSRs previously located at 1 DBH-1DEH. which performed the same function 
for early releases. 


See Section 18.12, “Last Branch, Call Stack, Interrupt, and Exception Recording for Processors based 
on Skylake Microarchitecture.” 


Register Address: 681H, 1665 MSR_LASTBRANCH_1_FROM_IP 


Last Branch Record 1 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 682H, 1666 MSR_LASTBRANCH_2_FROM_IP 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal Register Name 

: : te ek : er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
Last Branch Record 2 3,4,6 Unique 


See description of MSR_LASTBRANCH_O at 680H. 
Register Address: 683H, 1667 MSR_LASTBRANCH_3_FROM_IP 


Last Branch Record 3 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 684H, 1668 MSR_LASTBRANCH_4_FROM_IP 


Last Branch Record 4 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 685H, 1669 MSR_LASTBRANCH_5_FROM_IP 


Last Branch Record 5 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 686H, 1670 MSR_LASTBRANCH_6_FROM_IP 


Last Branch Record 6 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 687H, 1671 MSR_LASTBRANCH_7_FROM_IP 


Last Branch Record 7 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 688H, 1672 MSR_LASTBRANCH_8_FROM_IP 


Last Branch Record 8 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 689H, 1673 MSR_LASTBRANCH_9_FROM_IP 


Last Branch Record 9 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 68AH, 1674 MSR_LASTBRANCH_10_FROM_IP 


Last Branch Record 10 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 68BH, 1675 MSR_LASTBRANCH_11_FROM_IP 


Last Branch Record 11 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 68CH, 1676 MSR_LASTBRANCH_12_FROM_IP 


Last Branch Record 12 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 68DH, 1677 MSR_LASTBRANCH_13_FROM_IP 


Last Branch Record 13 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 68EH, 1678 MSR_LASTBRANCH_14_FROM_IP 


Last Branch Record 14 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 
Register Address: Hex, Decimal Register Name 


Model Shared/ 


Register Information / Bit Fields Bit Description Availability Unique! 


Register Address: 68FH, 1679 MSR_LASTBRANCH_15_FROM_IP 


Last Branch Record 15 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 680H. 


Register Address: 6COH, 1728 MSR_LASTBRANCH_O_TO_IP 


Last Branch Record 0 (R/W) 3,4,6 Unique 


One of 16 pairs of last branch record registers on the last branch record stack (6COH-6CFH). This part 
of the stack contains pointers to the destination instruction for one of the last 16 branches, 
exceptions, or interrupts that the processor took. 


See Section 18.12, “Last Branch, Call Stack, Interrupt, and Exception Recording for Processors based 
on Skylake Microarchitecture.” 


Register Address: 6C1H, 1729 MSR_LASTBRANCH_1_TO_IP 


Last Branch Record 1 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C2H, 1730 MSR_LASTBRANCH_2_TO_IP 


Last Branch Record 2 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C3H, 1731 MSR_LASTBRANCH_3_TO_IP 


Last Branch Record 3 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C4H, 1732 MSR_LASTBRANCH_4_TO_IP 


Last Branch Record 4 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C5H, 1733 MSR_LASTBRANCH_5_TO_IP 


Last Branch Record 5 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C6H, 1734 MSR_LASTBRANCH_6_TO_IP 


Last Branch Record 6 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C7H, 1735 MSR_LASTBRANCH_7_TO_IP 


Last Branch Record 7 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6C8H, 1736 MSR_LASTBRANCH_8_TO_IP 


Last Branch Record 8 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CSH, 1737 MSR_LASTBRANCH_9_TO_IP 


Last Branch Record 9 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CAH, 1738 MSR_LASTBRANCH_10_TO_IP 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal Register Name 

: : sf ek : er Model Shared/ 
Register Information / Bit Fields Bit Description Availability Unique! 
Last Branch Record 10 3,4,6 Unique 


See description of MSR_LASTBRANCH_O at 6COH. 
Register Address: 6CBH, 1739 MSR_LASTBRANCH_11_TO_IP 


Last Branch Record 11 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CCH, 1740 MSR_LASTBRANCH_12_TO_IP 


Last Branch Record 12 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CDH, 1741 MSR_LASTBRANCH_13_TO_IP 


Last Branch Record 13 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CEH, 1742 MSR_LASTBRANCH_14_TO_IP 


Last Branch Record 14 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: 6CFH, 1743 MSR_LASTBRANCH_15_TO_IP 


Last Branch Record 15 3,4,6 Unique 
See description of MSR_LASTBRANCH_O at 6COH. 


Register Address: COOO_O080H IA32_EFER 


Extended Feature Enables 3,4,6 Unique 
See Table 2-2. 


Register Address: COO0_0081H IA32_STAR 


System Call Target Address (R/W) 3,4,6 Unique 
See Table 2-2. 


Register Address: COOO_0082H IA32_LSTAR 


IA-32e Mode System Call Target Address (R/W) 3,4,6 Unique 
See Table 2-2. 


Register Address: COO0_0084H IA32_FMASK 


System Call Flag Mask (R/W) 3,4,6 Unique 
See Table 2-2. 


Register Address: COO0_0100H IA32_FS_BASE 


Map of BASE Address of FS (R/W) 3,4,6 Unique 
See Table 2-2. 


Register Address: COO0_0101H IA32_GS_BASE 


Map of BASE Address of GS (R/W) 3,4,6 Unique 
See Table 2-2. 


Register Address: CO00_0102H IA32_KERNEL_GS_BASE 


Swap Target of BASE Address of GS (R/W) 3,4,6 Unique 
See Table 2-2. 
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Table 2-58. MSRs in the Pentium® 4 and Intel® Xeon® Processors (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Model 
Availability 


Shared/ 
Unique! 


NOTES 


1. For HT-enabled processors, there may be more than one logical processors per physical unit. If an MSR is Shared, this means that 
one MSR is shared between logical processors. If an MSR is unique, this means that each logical processor has its own MSR. 


2.19.1 


MSRs Unique to Intel® Xeon® Processor MP with L3 Cache 


The MSRs listed in Table 2-59 apply to Intel® Xeon® Processor MP with up to 8MB level three cache. These proces- 
sors can be detected by enumerating the deterministic cache parameter leaf of CPUID instruction (with EAX = 4 as 
input) to detect the presence of the third level cache, and with CPUID reporting family encoding OFH, model 


encoding 3 or 4 (see CPUID instruction for more details). 


Table 2-59. MSRs Unique to 64-bit Intel® Xeon® Processor MP with Up to an 8 MB L3 Cache 


Register Address: Hex 


Register Name 


Register Information 


Model 
Availability 


Shared/ 
Unique 


Register Address: 107CCH MSR_IFSB_BUSQO 


IFSB BUSQ Event Control and Counter Register (R/W) 


L3 Cache.” 


See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte 


3,4 


Shared 


Register Address: 107CDH MSR_IFSB_BUSQ1 


IFSB BUSQ Event Control and Counter Register (R/W) 


3,4 


Shared 


Register Address: 107CEH MSR_IFSB_SNPQO 


IFSB SNPQ Event Control and Counter Register (R/W) 


L3 Cache.” 
Register Address: 107CFH MSR_IFSB_SNPQ1 


See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte 


3,4 


Shared 


IFSB SNPQ Event Control and Counter Register (R/W) 
Register Address: 107D0H MSR_EFSB_DRDYO 


3,4 


Shared 


EFSB DRDY Event Control and Counter Register (R/W) 


L3 Cache.” 


See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte 


3,4 


Shared 


Register Address: 107D1H MSR_EFSB_DRDY1 


EFSB DRDY Event Control and Counter Register (R/W) 


3,4 


Shared 


Register Address: 107D2H MSR_IFSB_CTL6 


IFSB Latency Event Control Register (R/W) 


L3 Cache.” 


See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte 


3,4 


Shared 


Register Address: 107D3H MSR_IFSB_CNTR7 


IFSB Latency Event Counter Register (R/W) 


L3 Cache.” 


See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte 


3,4 


Shared 


The MSRs listed in Table 2-60 apply to Intel® Xeon® Processor 7100 series. These processors can be detected by 
enumerating the deterministic cache parameter leaf of CPUID instruction (with EAX = 4 as input) to detect the 
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presence of the third level cache, and with CPUID reporting family encoding OFH, model encoding 6 (See CPUID 
instruction for more details.). The performance monitoring MSRs listed in Table 2-60 are shared between logical 


processors in the same core, but are replicated for each core. 


Table 2-60. MSRs Unique to Intel® Xeon® Processor 7100 Series 


Register Address: Hex Register Name 
Register Information cen ty ene 

Register Address: 107CCH MSR_EMON_L3_CTR_CTLO 
GBUSQ Event Control and Counter Register (R/W) 6 Shared 
See Section 20.6.6, “Performance Monitoring on 64-bit Intel® Xeon® Processor MP with Up to 8-MByte L3 
Cache." 
Register Address: 107CDH MSR_EMON_L3_CTR_CTL1 
GBUSQ Event Control and Counter Register (R/W) 6 Shared 
Register Address: 107CEH MSR_EMON_L3_CTR_CTL2 
GSNPQ Event Control and Counter Register (R/W) 6 Shared 
See Section 20.6.6, “Performance Monitoring on 64-bit Intel? Xeon® Processor MP with Up to 8-MByte L3 
Cache." 
Register Address: 107CFH MSR_EMON_L3_CTR_CTL3 
GSNPQ Event Control and Counter Register (R/W) 6 Shared 
Register Address: 107D0H MSR_EMON_L3_CTR_CTL4 
FSB Event Control and Counter Register (R/W) 6 Shared 
See Section 20.6.6, “Performance Monitoring on 64-bit Intel® Xeon® Processor MP with Up to 8-MByte L3 
Cache." 
Register Address: 107D1H MSR_EMON_L3_CTR_CTL5 
FSB Event Control and Counter Register (R/W) 6 Shared 
Register Address: 107D2H MSR_EMON_L3_CTR_CTL6 
FSB Event Control and Counter Register (R/W) 6 Shared 
Register Address: 107D3H MSR_EMON_L3_CTR_CTL7 
FSB Event Control and Counter Register (R/W) 6 Shared 


2.20 MSRSIN INTEL® CORE™ SOLO AND INTEL® CORE™ DUO PROCESSORS 


Model-specific registers (MSRs) for Intel Core Solo, Intel Core Duo processors, and Dual-core Intel Xeon processor 
LV are listed in Table 2-61. The column “Shared/Unique” applies to Intel Core Duo processor. “Unique” means each 
processor core has a separate MSR, or a bit field in an MSR governs only a core independently. “Shared” means the 


MSR or the bit field in an MSR address governs the operation of both processor cores. 


Table 2-61. MSRs in Intel® Core™ Solo, Intel? Core™ Duo Processors, and Dual-Core Intel® Xeon® Processor LV 


Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description ice 
Register Address: OH, O P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors,” and Table 2-2. Unique 
Register Address: 1H, 1 P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors,” and Table 2-2. Unique 
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Table 2-61. MSRs in Intel® Core™ Solo, Intel? Core™ Duo Processors, and Dual-Core Intel® Xeon® Processor LV (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ae 
Register Address: 6H, 6 IA32_MONITOR_FILTER_SIZE 
See Section 9.10.5, “Monitor/Mwait Address Range Determination,” and Table 2-2. Unique 
Register Address: 10H, 16 IA32_TIME_STAMP_COUNTER 
See Section 18.17, “Time-Stamp Counter,” and Table 2-2. Unique 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) Shared 
See Table 2-2. The operating system can use this MSR to determine “slot” information for the processor and the proper 
microcode update to load. 
Register Address: 1BH, 27 IA32_APIC_BASE 
See Section 11.4.4, “Local APIC Status and Location,” and Table 2-2. Unique 
Register Address: 2AH, 42 MSR_EBL_CR_POWERON 
Processor Hard Power-On Configuration (R/W) Shared 
Enables and disables processor features; (R) indicates current processor configuration. 
0 Reserved. 
1 Data Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processor implements R/W. 
2 Response Error Checking Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processor implements R/W. 
3 MCERR# Drive Enable (R/W) 
1 = Enabled; O = Disabled. 
Note: Not all processor implements R/W. 
4 Address Parity Enable (R/W) 
1 = Enabled; 0 = Disabled. 
Note: Not all processor implements R/W. 
6:5 Reserved. 
7 BINIT# Driver Enable (R/W) 
1 = Enabled; O = Disabled. 
Note: Not all processor implements R/W. 
8 Output Tri-state Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
9 Execute BIST (R/O) 
1 = Enabled; 0 = Disabled. 
10 MCERR# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
11 Reserved. 
12 BINIT# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
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Table 2-61. MSRs in Intel® Core™ Solo, Intel® Core™ Duo Processors, and Dual-Core Intel® Xeon® Processor LV (Contd.) 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description iiae 
13 Reserved 
14 1 MByte Power on Reset Vector (R/O) 
1 = 1 MByte; 0 = 4 GBytes 
15 Reserved. 
17:16 APIC Cluster ID (R/O) 
18 System Bus Frequency (R/O) 
0 = 100 M#z. 
1 = Reserved. 
19 Reserved. 
21:20 Symmetric Arbitration ID (R/O) 
26:22 Clock Frequency Ratio (R/O) 
Register Address: 3AH, 58 IA32_FEATURE_CONTROL 
Control Features in IA-32 Processor (R/W) Unique 
See Table 2-2. 
Register Address: 40H, 64 MSR_LASTBRANCH_O 
Last Branch Record 0 (R/W) Unique 
One of 8 last branch record registers on the last branch record stack: bits 31-0 hold the ‘from’ address and bits 63-32 
hold the ‘to’ address. See also: 
« Last Branch Record Stack TOS at 1C9SH. 
* Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors).” 
Register Address: 41H, 65 MSR_LASTBRANCH_1 
Last Branch Record 1 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 42H, 66 MSR_LASTBRANCH_2 
Last Branch Record 2 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 43H, 67 MSR_LASTBRANCH_3 
Last Branch Record 3 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 44H, 68 MSR_LASTBRANCH_4 
Last Branch Record 4 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 45H, 69 MSR_LASTBRANCH_5 
Last Branch Record 5 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 46H, 70 MSR_LASTBRANCH_6 
Last Branch Record 6 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 
Register Address: 47H, 71 MSR_LASTBRANCH_7 
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Table 2-61. MSRs in Intel® Core™ Solo, Intel? Core™ Duo Processors, and Dual-Core Intel® Xeon® Processor LV (Contd.) 


Register Address: Hex, Decimal Register Name 


See Table 2-2. 


Register Information / Bit Fields Bit Description Tide 
Last Branch Record 7 (R/W) Unique 
See description of MSR_LASTBRANCH_O. 

Register Address: 79H, 121 IA32_BIOS_UPDT_TRIG 

BIOS Update Trigger Register (W) Unique 
See Table 2-2. 

Register Address: 8BH, 139 IA32_BlOS_SIGN_ID 

BIOS Update Signature ID (R/W) Unique 
See Table 2-2. 

Register Address: C1H, 193 IA32_PMCO 

Performance Counter Register Unique 


Register Address: C2H, 194 IA32_PMC1 


Used to configure the L2 Cache. 


Performance Counter Register Unique 
See Table 2-2. 
Register Address: CDH, 205 MSR_FSB_FREQ 
Scaleable Bus Speed (R/O) Shared 
This field indicates the scalable bus clock speed. 
2:0 * 101B: 100 MHz (FSB 400) 
* 001B: 133 MHz (FSB 533) 
« 011B: 167 MHz (FSB 667) 
133.33 MHz should be utilized if performing calculation with System Bus Speed 
when encoding is 101B. 
166.67 MHz should be utilized if performing calculation with System Bus Speed 
when encoding is 001B. 
63:3 Reserved. 
Register Address: E7H, 231 IA32_MPERF 
Maximum Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: E8H, 232 IA32_APERF 
Actual Performance Frequency Clock Count (R/W) Unique 
See Table 2-2. 
Register Address: FEH, 254 IA32_MTRRCAP 
See Table 2-2. Unique 
Register Address: 11€H, 281 MSR_BBL_CR_CTL3 
Control Register 3 Shared 


0 L2 Hardware Enabled (R/O) 
1 = If the L2 is hardware-enabled. 
O= Indicates if the L2 is hardware-disabled. 
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Table 2-61. MSRs in Intel® Core™ Solo, Intel® Core™ Duo Processors, and Dual-Core Intel® Xeon® Processor LV (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description iiae 
71 Reserved. 
L2 Enabled (R/W) 
1 = Ld cache has been initialized. 
O= Disabled (default). 
Until this bit is set the processor will not respond to the WBINVD instruction or 
the assertion of the FLUSH# input. 
22:9 Reserved. 
23 L2 Not Present (R/O) 
O= Ld Present. 
1=  L2 Not Present. 
63:24 Reserved. 
Register Address: 174H, 372 IA32_SYSENTER_CS 
See Table 2-2. Unique 
Register Address: 175H, 373 IA32_SYSENTER_ESP 
See Table 2-2. Unique 
Register Address: 176H, 374 IA32_SYSENTER_EIP 
See Table 2-2. Unique 
Register Address: 179H, 377 IA32_MCG_CAP 
See Table 2-2. Unique 
Register Address: 17AH, 378 IA32_MCG_STATUS 
Global Machine Check Status Unique 
0 RIPV 
When set, this bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) can be 
used to restart the program. If this bit is cleared, the program cannot be reliably 
restarted. 
1 EIPV 
When set, this bit indicates that the instruction addressed by the instruction 
pointer pushed on the stack (when the machine check was generated) is directly 
associated with the error. 
2 MCIP 
When set, this bit indicates that a machine check has been generated. If a second 
machine check is detected while this bit is still set, the processor enters a 
shutdown state. Software should write this bit to O after processing a machine 
check exception. 
63:3 Reserved 
Register Address: 186H, 390 IA32_PERFEVTSELO 
See Table 2-2. Unique 
Register Address: 187H, 391 IA32_PERFEVTSEL1 
See Table 2-2. Unique 


Register Address: 198H, 408 


IA32_PERF_STATUS 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description ge 
See Table 2-2. Shared 
Register Address: 199H, 409 IA32_PERF_CTL 
See Table 2-2. Unique 
Register Address: 19AH, 410 IA32_CLOCK_MODULATION 
Clock Modulation (R/W) Unique 
See Table 2-2. 
Register Address: 19BH, 411 IA32_THERM_INTERRUPT 
Thermal Interrupt Control (R/W) Unique 
See Table 2-2 and Section 15.8.2, “Thermal Monitor.” 
Register Address: 19CH, 412 IA32_THERM_STATUS 
Thermal Monitor Status (R/W) Unique 
See Table 2-2 and Section 15.8.2, “Thermal Monitor”. 
Register Address: 19DH, 413 MSR_THERM2_CTL 
Thermal Monitor 2 Control Unique 
15:0 Reserved. 
16 TM_SELECT (R/W) 
Mode of automatic thermal monitor: 
O= Thermal Monitor 1 (thermally-initiated on-die modulation of the stop-clock 
duty cycle) 
1= Thermal Monitor 2 (thermally-initiated frequency transitions) 
If bit 3 of the IA32_MISC_ENABLE register is cleared, TM_SELECT has no effect. 
Neither TM1 nor TM2 will be enabled. 
63:16 Reserved. 
Register Address: 1AQH, 416 IA32_MISC_ENABLE 
Enable Miscellaneous Processor Features (R/W) 
Allows a variety of processor functions to be enabled and disabled. 
2:0 Reserved. 
3 Automatic Thermal Control Circuit Enable (R/W) Unique 
See Table 2-2. 
6:4 Reserved. 
7 Performance Monitoring Available (R) Shared 
See Table 2-2. 
9:8 Reserved. 
10 FERR# Multiplexing Enable (R/W) Shared 
1 = FERR# asserted by the processor to indicate a pending break event within 
the processor 
O= Indicates compatible FERR# signaling behavior 
This bit must be set to 1 to support XAPIC interrupt model usage. 
11 Branch Trace Storage Unavailable (R/O) Shared 


See Table 2-2. 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description thieue 
12 Reserved. 
13 TM2 Enable (R/W) Shared 
When this bit is set (1) and the thermal sensor indicates that the die temperature 
is at the pre-determined threshold, the Thermal Monitor 2 mechanism is 
engaged. TM2 will reduce the bus to core ratio and voltage according to the value 
last written to MSR_THERM2_CTL bits 15:0. 
When this bit is clear (0, default), the processor does not change the VID signals 
or the bus to core ratio when the processor enters a thermal managed state. 
If the TM2 feature flag (ECX[8]) is not set to 1 after executing CPUID with EAX = 
1, then this feature is not supported and BIOS must not alter the contents of this 
bit location. The processor is operating out of spec if both this bit and the TM1 
bit are set to disabled states. 
15:14 Reserved. 
16 Enhanced Intel SpeedStep Technology Enable (R/W) Shared 
1 = Enhanced Intel SpeedStep Technology enabled 
18 ENABLE MONITOR FSM (R/W) Shared 
See Table 2-2. 
19 Reserved. 
22 Limit CPUID Maxval (R/W) Shared 
See Table 2-2. 
Setting this bit may cause behavior in software that depends on the availability 
of CPUID leaves greater than 2. 
33:23 Reserved. 
34 XD Bit Disable (R/W) Shared 
See Table 2-3. 
63:35 Reserved. 
Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 
Last Branch Record Stack TOS (R/W) Unique 
Contains an index (bits 0-3) that points to the MSR containing the most recent branch record. 
See MSR_LASTBRANCH_O_FROM_IP (at 40H). 
Register Address: 1D9H, 473 IA32_DEBUGCTL 
Debug Control (R/W) Unique 
Controls how several debug features are used. Bit definitions are discussed in Table 2-2. 
Register Address: 1DDH, 477 MSR_LER_FROM_LIP 
Last Exception Record From Linear IP (R) Unique 
Contains a pointer to the last branch instruction that the processor executed prior to the last exception that was 
generated or the last interrupt that was handled. 
Register Address: 1DEH, 478 MSR_LER_TO_LIP 
Last Exception Record To Linear IP (R) Unique 
This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last 
exception that was generated or the last interrupt that was handled. 
Register Address: 200H, 512 MTRRphysBaseO 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Tae 
Memory Type Range Registers Unique 
Register Address: 201H, 513 MTRRphysMaskO 

Memory Type Range Registers Unique 
Register Address: 202H, 514 MTRRphysBase1 

Memory Type Range Registers Unique 
Register Address: 203H, 515 MTRRphysMask1 

Memory Type Range Registers Unique 
Register Address: 204H, 516 MTRRphysBase2 

Memory Type Range Registers Unique 
Register Address: 205H, 517 MTRRphysMask2 

Memory Type Range Registers Unique 
Register Address: 206H, 518 MTRRphysBase3 

Memory Type Range Registers Unique 
Register Address: 207H, 519 MTRRphysMask3 

Memory Type Range Registers Unique 
Register Address: 208H, 520 MTRRphysBase4 

Memory Type Range Registers Unique 
Register Address: 209H, 521 MTRRphysMask4 

Memory Type Range Registers Unique 
Register Address: 20AH, 522 MTRRphysBase5 

Memory Type Range Registers Unique 
Register Address: 20BH, 523 MTRRphysMask5 

Memory Type Range Registers Unique 
Register Address: 20CH, 524 MTRRphysBase6 

Memory Type Range Registers Unique 
Register Address: 20DH, 525 MTRRphysMask6 

Memory Type Range Registers Unique 
Register Address: 20EH, 526 MTRRphysBase7 

Memory Type Range Registers Unique 
Register Address: 20FH, 527 MTRRphysMask7 

Memory Type Range Registers Unique 
Register Address: 250H, 592 MTRRfix64K_OO000 

Memory Type Range Registers Unique 
Register Address: 258H, 600 MTRRfix16K_80000 

Memory Type Range Registers Unique 
Register Address: 259H, 601 MTRRfix16K_AO000 

Memory Type Range Registers Unique 
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Register Address: Hex, Decimal Register Name 

Register Information / Bit Fields Bit Description ae 
Register Address: 268H, 616 MTRRfix4K_COO00 
Memory Type Range Registers Unique 
Register Address: 269H, 617 MTRRfix4K_C8000 
Memory Type Range Registers Unique 
Register Address: 26AH, 618 MTRRfix4K_DOOOO 
Memory Type Range Registers Unique 
Register Address: 26BH, 619 MTRRfix4K_D8000 
Memory Type Range Registers Unique 
Register Address: 26CH, 620 MTRRfix4K_EO000 
Memory Type Range Registers Unique 
Register Address: 26DH, 621 MTRRfix4K_E8000 
Memory Type Range Registers Unique 
Register Address: 26EH, 622 MTRRfix4K_FOOOO 
Memory Type Range Registers Unique 
Register Address: 26FH, 623 MTRRfix4K_F8000 
Memory Type Range Registers Unique 
Register Address: 2FFH, 767 IA32_MTRR_DEF_TYPE 
Default Memory Types (R/W) Unique 
See Table 2-2 and Section 12.11.2.1, “IA32_MTRR_DEF_TYPE MSR.” 
Register Address: 400H, 1024 IA32_MCO_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Unique 
Register Address: 401H, 1025 IA32_MCO_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Unique 
Register Address: 402H, 1026 IA32_MCO_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Unique 
The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MCO_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will 
cause a general-protection exception. 
Register Address: 404H, 1028 IA32_MC1_CTL 
See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” Unique 
Register Address: 405H, 1029 IA32_MC1_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” Unique 
Register Address: 406H, 1030 IA32_MC1_ADDR 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” Unique 
The IA32_MC1_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC1_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will 
cause a general-protection exception. 


Register Address: 408H, 1032 IA32_MC2_CTL 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 


Shared/ 
Unique 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Unique 


Register Address: 409H, 1033 IA32_MC2_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Unique 


Register Address: 40AH, 1034 IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
IA32_MC2_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will 
cause a general-protection exception. 


Unique 


Register Address: 40CH, 1036 MSR_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 
Register Address: 40DH, 1037 MSR_MC4_STATUS 


Unique 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Unique 


Register Address: 40EH, 1038 MSR_MC4_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC4_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will cause 
a general-protection exception. 


Unique 


Register Address: 410H, 1040 


IA32_MC3_CTL See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 
Register Address: 411H, 1041 


IA32_MC3_STATUS See Section 16.3.2.2, “IA32_MCi_STATUS MSRS." 


Register Address: 412H, 1042 MSR_MC3_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the 
MSR_MC3_STATUS register is clear. When not implemented in the processor, all reads and writes to this MSR will cause 
a general-protection exception. 


Unique 


Register Address: 413H, 1043 MSR_MC3_MISC 


Machine Check Error Reporting Register - contains additional information describing the machine-check error if the 
MISCV flag in the IA32_MCi_STATUS register is set. 


Unique 


Register Address: 414H, 1044 MSR_MC5_CTL 


Machine Check Error Reporting Register - controls signaling of #MC for errors produced by a particular hardware unit 
(or group of hardware units). 


Register Address: 415H, 1045 MSR_MC5_STATUS 


Unique 


Machine Check Error Reporting Register - contains information related to a machine-check error if its VAL (valid) flag is 
set. Software is responsible for clearing IA32_MCi_STATUS MSRs by explicitly writing Os to them; writing 1s to them 
causes a general-protection exception. 


Unique 


Register Address: 416H, 1046 MSR_MC5_ADDR 


Machine Check Error Reporting Register - contains the address of the code or data memory location that produced the 
machine-check error if the ADDRV flag in the [A32_MCi_STATUS register is set. 


Register Address: 417H, 1047 MSR_MC5_MISC 


Unique 
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Register Address: Hex, Decimal Register Name 


Shared/ 


Register Information / Bit Fields Bit Description : 
Unique 


Machine Check Error Reporting Register - contains additional information describing the machine-check error if the Unique 
MISCV flag in the IA32_MCi_STATUS register is set. 


Register Address: 480H, 1152 IA32_VMX_BASIC 


Reporting Register of Basic VMX Capabilities (R/O) Unique 
See Table 2-2 and Appendix A.1, “Basic VMX Information.” (If CPUID.01H:ECX.[bit 5]) 


Register Address: 481H, 1153 IA32_WVMX_PINBASED_CTLS 


Capability Reporting Register of Pin-Based VM-Execution Controls (R/O) Unique 
See Appendix A.3, “VM-Execution Controls.” (If CPUID.O1H:ECX.[bit 5]) 


Register Address: 482H, 1154 IA32_VMX_PROCBASED_CTLS 


Capability Reporting Register of Primary Processor-Based VM-Execution Controls (R/O) Unique 
See Appendix A.3, “VM-Execution Controls.” (If CPUID.O1H:ECX.[bit 5]) 


Register Address: 483H, 1155 IA32_VMX_EXIT_CTLS 


Capability Reporting Register of VM-Exit Controls (R/O) Unique 
See Appendix A.4, “VM-Exit Controls.” (If CPUID.O1H:ECX.[bit 5]) 


Register Address: 484H, 1156 IA32_VMX_ENTRY_CTLS 


Capability Reporting Register of VM-Entry Controls (R/O) Unique 
See Appendix A.5, “VM-Entry Controls.” (If CPUID.O1H:ECX.[bit 5]) 


Register Address: 485H, 1157 IA32_VMX_MISC 


Reporting Register of Miscellaneous VMX Capabilities (R/O) Unique 
See Appendix A.6, “Miscellaneous Data.” (If CPUID.O1H:ECX.[bit 5]) 


Register Address: 486H, 1158 IA32_VMX_CRO_FIXEDO 


Capability Reporting Register of CRO Bits Fixed to 0 (R/O) Unique 
See Appendix A.7, “VMX-Fixed Bits in CRO.” (If CPUID.01H:ECX.[bit 5]) 


Register Address: 487H, 1159 IA32_WMX_CRO_FIXED1 


Capability Reporting Register of CRO Bits Fixed to 1 (R/O) Unique 
See Appendix A.7, “VMX-Fixed Bits in CRO.” (If CPUID.01H:ECX.[bit 5]) 


Register Address: 488H, 1160 IA32_VMX_CR4_FIXEDO 


Capability Reporting Register of CR4 Bits Fixed to 0 (R/O) Unique 
See Appendix A.8, “VMX-Fixed Bits in CR4.” (If CPUID.01 H:ECX.[bit 5]) 


Register Address: 489H, 1161 IA32_WMX_CR4_FIX€D1 


Capability Reporting Register of CR4 Bits Fixed to 1 (R/O) Unique 
See Appendix A.8, “VMX-Fixed Bits in CR4.” (If CPUID.01 H:ECX.[bit 5]) 


Register Address: 48AH, 1162 IA32_VMX_VMCS_ENUM 


Capability Reporting Register of VMCS Field Enumeration (R/O) Unique 
See Appendix A.9, “VMCS Enumeration.” (If CPUID.01H:ECX.[bit 5]) 


Register Address: 48BH, 1163 IA32_VMX_PROCBASED_CTLS2 


Capability Reporting Register of Secondary Processor-Based VM-Execution Controls (R/O) Unique 
See Appendix A.3, “VM-Execution Controls.” (If CPUID.O1H:ECX.[bit 5] and IA32_VMX_PROCBASED_CTLS[bit 63]) 


Register Address: 600H, 1536 IA32_DS_AREA 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description Tide 
DS Save Area (R/W) Unique 
See Table 2-2 and Section 20.6.3.4, “Debug Store (DS) Mechanism.” 
31:0 DS Buffer Management Area 
Linear address of the first byte of the DS buffer management area. 
63:32 Reserved. 
Register Address: COOO_O080H IA32_EFER 
See Table 2-2. Unique 
10:0 Reserved. 
11 Execute Disable Bit Enable 
63:12 Reserved. 


2.21 MSRS IN THE PENTIUM M PROCESSOR 


Model-specific registers (MSRs) for the Pentium M processor are similar to those described in Section 2.22 for P6 
family processors. The following table describes new MSRs and MSRs whose behavior has changed on the Pentium 


M processor. 


Table 2-62. MSRs in Pentium M Processors 


Register Address: Hex, Decimal Register Name 


Register Address: OH, 0 


Register Information / Bit Fields Bit Description 


P5_MC_ADDR 


See Section 2.23, “MSRs in Pentium Processors.” 


Register Address: 1H, 1 


See Section 2.23, “MSRs in Pentium Processors.” 


P5_MC_TYPE 


Register Address: 10H, 16 


IA32_TIME_STAMP_COUNTER 


See Section 18.17, “Time-Stamp Counter,” and see Table 2-2. 


Register Address: 17H, 23 


IA32_PLATFORM_ID 


Platform ID (R) 
See Table 2-2. 


The operating system can use this MSR to determine “slot” information for the processor and the proper microcode update to load. 


Register Address: 2AH, 42 MSR_EBL_CR_POWERON 


Processor Hard Power-On Configuration 
(R/W) Enables and disables processor features. 


(R) Indicates current processor configuration. 
0 Reserved. 
1 Data Error Checking Enable (R) 
0 = Disabled. 
Always 0 on the Pentium M processor. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Response Error Checking Enable (R) 
0 = Disabled. 
Always 0 on the Pentium M processor. 


MCERR# Drive Enable (R) 
0 = Disabled. 
Always O on the Pentium M processor. 


Address Parity Enable (R) 
0 = Disabled. 
Always 0 on the Pentium M processor. 


Reserved. 


BINIT# Driver Enable (R) 
1 = Enabled; 0 = Disabled. 
Always 0 on the Pentium M processor. 


Output Tri-state Enabled (R/O) 
1 = Enabled; 0 = Disabled. 


Execute BIST (R/O) 
1 = Enabled; 0 = Disabled. 


11 


MCERR# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
Always 0 on the Pentium M processor. 


Reserved. 


12 


BINIT# Observation Enabled (R/O) 
1 = Enabled; 0 = Disabled. 
Always 0 on the Pentium M processor. 


13 


Reserved. 


14 


1 MByte Power on Reset Vector (R/O) 
1 = 1 MByte; 0 = 4 GBytes. 
Always O on the Pentium M processor. 


Reserved. 


17:16 


APIC Cluster ID (R/O) 
Always OOB on the Pentium M processor. 


System Bus Frequency (R/O) 

0 = 100 MHz. 

1 = Reserved. 

Always 0 on the Pentium M processor. 


19 


Reserved. 


21:20 


Symmetric Arbitration ID (R/O) 
Always OOB on the Pentium M processor. 


26:22 


Clock Frequency Ratio (R/O) 


Register Address: 40H, 64 


MSR_LASTBRANCH_O 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Last Branch Record 0 (R/W) 


One of 8 last branch record registers on the last branch record stack: bits 31-0 hold the ‘from’ address and bits 63-32 hold the to 


address. 
See also: 
* Last Branch Record Stack TOS at 1C9H. 


* Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors).” 


Register Address: 41H, 65 


MSR_LASTBRANCH_1 


Last Branch Record 1 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 42H, 66 


MSR_LASTBRANCH_2 


Last Branch Record 2 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 43H, 67 


MSR_LASTBRANCH_3 


Last Branch Record 3 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 44H, 68 


MSR_LASTBRANCH_4 


Last Branch Record 4 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 45H, 69 


Last Branch Record 5 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 46H, 70 


MSR_LASTBRANCH_5 


MSR_LASTBRANCH_6 


Last Branch Record 6 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 47H, 71 


MSR_LASTBRANCH_7 


Last Branch Record 7 (R/W) 
See description of MSR_LASTBRANCH_O. 


Register Address: 119H, 281 


MSR_BBL_CR_CTL 


Control Register 


Used to program L2 commands to be issued via cache configuration accesses mechanism. Also receives L2 lookup response. 


63:0 


Reserved. 


Register Address: 11€H, 281 


MSR_BBL_CR_CTL3 


Control Register 3 
Used to configure the L2 Cache. 


0 L2 Hardware Enabled (R/O) 

1 = If the L2 is hardware-enabled. 

0 = Indicates if the L2 is hardware-disabled. 
4:1 Reserved. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields Bit Description 
5 ECC Check Enable (R/O) 
This bit enables ECC checking on the cache data bus. ECC is always generated on 
write cycles. 
0 = Disabled (default). 
1 = Enabled. 
For the Pentium M processor, ECC checking on the cache data bus is always enabled. 
7:6 Reserved. 
L2 Enabled (R/W) 
1 = L2 cache has been initialized. 
0 = Disabled (default). 
Until this bit is set the processor will not respond to the WBINVD instruction or the 
assertion of the FLUSH# input. 
22:9 Reserved. 
23 L2 Not Present (R/O) 
0 =L2 Present. 
1 = L2 Not Present. 
63:24 Reserved. 
Register Address: 179H, 377 IA32_MCG_CAP 


Read-only register that provides information about the machine-check architecture of the processor. 


7:0 


Count (R/O) 


Indicates the number of hardware unit error reporting banks available in the 
processor. 


IA32_MCG_CTL Present (R/O) 


1 = Indicates that the processor implements the MSR_MCG_CTL register found at 
MSR 17BH. 


O = Not supported. 


63:9 
Register Address: 17AH, 378 


Reserved. 
IA32_MCG_STATUS 


Global Machine Check Status 


0 


RIPV 


When set, this bit indicates that the instruction addressed by the instruction pointer 
pushed on the stack (when the machine check was generated) can be used to restart 
the program. If this bit is cleared, the program cannot be reliably restarted. 


EIPV 


When set, this bit indicates that the instruction addressed by the instruction pointer 
pushed on the stack (when the machine check was generated) is directly associated 
with the error. 


MCIP 


When set, this bit indicates that a machine check has been generated. If a second 
machine check is detected while this bit is still set, the processor enters a shutdown 
state. Software should write this bit to O after processing a machine check exception. 


63:3 
Register Address: 198H, 408 


Reserved. 
IA32_PERF_STATUS 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


See Table 2-2. 


Register Address: 199H, 409 


IA32_PERF_CTL 


See Table 2-2. 


Register Address: 19AH, 410 


IA32_CLOCK_MODULATION 


Clock Modulation (R/W). 


See Table 2-2 and Section 15.8.3, “Software Controlled Clock Modulation.” 


Register Address: 19BH, 411 


IA32_THERM_INTERRUPT 


Thermal Interrupt Control (R/W) 


See Table 2-2 and Section 15.8.2, “Thermal Monitor.” 


Register Address: 19CH, 412 


IA32_THERM_STATUS 


Thermal Monitor Status (R/W) 


See Table 2-2 and Section 15.8.2, “Thermal Monitor.” 


Register Address: 19DH, 413 


MSR_THERM2_CTL 


Thermal Monitor 2 Control 


15:0 Reserved. 
16 TM_SELECT (R/W) 
Mode of automatic thermal monitor: 
Q= Thermal Monitor 1 (thermally-initiated on-die modulation of the stop-clock duty 
cycle) 
1= Thermal Monitor 2 (thermally-initiated frequency transitions) 
If bit 3 of the IA32_MISC_ENABLE register is cleared, TM_SELECT has no effect. 
Neither TM1 nor TM2 will be enabled. 
63:16 Reserved. 


Register Address: 1A0H, 416 


IA32_MISC_ENABLE 


Enable Miscellaneous Processor Features (R/W) 


Allows a variety of processor functions to be enabled and disabled. 


2:0 Reserved. 
3 Automatic Thermal Control Circuit Enable (R/W) 
1 = Setting this bit enables the thermal control circuit (TCC) portion of the Intel 
Thermal Monitor feature. This allows processor clocks to be automatically 
modulated based on the processor's thermal sensor operation. 
O= Disabled (default). 
The automatic thermal control circuit enable bit determines if the thermal control 
circuit (TCC) will be activated when the processor's internal thermal sensor 
determines the processor is about to exceed its maximum operating temperature. 
When the TCC is activated and TM1 is enabled, the processors clocks will be forced to 
a 50% duty cycle. BIOS must enable this feature. 
The bit should not be confused with the on-demand thermal control circuit enable bit. 
6:4 Reserved. 
7 Performance Monitoring Available (R) 


|= 
O= 


Performance monitoring enabled. 
Performance monitoring disabled. 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description 
9:8 Reserved. 
10 FERR# Multiplexing Enable (R/W) 
1 = FERR# asserted by the processor to indicate a pending break event within the 
processor. 


O= Indicates compatible FERR# signaling behavior. 
This bit must be set to 1 to support XAPIC interrupt model usage. 


Branch Trace Storage Unavailable (R/O) 
1 = Processor doesn't support branch trace storage (BTS) 
O= BTS is supported 


12 Processor Event Based Sampling Unavailable (R/O) 

1 = Processor does not support processor event based sampling (PEBS); 
O= _ PEBS is supported. 

The Pentium M processor does not support PEBS. 

15:13 Reserved. 

16 Enhanced Intel SpeedStep Technology Enable (R/W) 

1= Enhanced Intel SpeedStep Technology enabled. 

On the Pentium M processor, this bit may be configured to be read-only. 
22:17 Reserved. 


23 XTPR Message Disable (R/W) 


When set to 1, XTPR messages are disabled. xTPR messages are optional messages 
that allow the processor to inform the chipset of its priority. The default is processor 


specific. 
63:24 Reserved. 
Register Address: 1C9H, 457 MSR_LASTBRANCH_TOS 


Last Branch Record Stack TOS (R/W) 
Contains an index (bits 0-3) that points to the MSR containing the most recent branch record. See also: 


* MSR_LASTBRANCH_O_FROM_IP (at 40H). 
* Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors).” 


Register Address: 1D9H, 473 MSR_DEBUGCTLB 

Debug Control (R/W) 

Controls how several debug features are used. Bit definitions are discussed in the referenced section. 
See Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors).” 


Register Address: 1DDH, 477 MSR_LER_TO_LIP 


Last Exception Record To Linear IP (R) 


This area contains a pointer to the target of the last branch instruction that the processor executed prior to the last exception that 
was generated or the last interrupt that was handled. 

See Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors),” and Section 18.16.2, “Last Branch and 
Last Exception MSRs.” 


Register Address: 1DEH, 478 MSR_LER_FROM_LIP 


2-496 Vol. 4 


MODEL-SPECIFIC REGISTERS (MSRS) 


Table 2-62. MSRs in Pentium M Processors (Contd.) 


Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Last Exception Record From Linear IP (R) 


Contains a pointer to the last branch instruction 
last interrupt that was handled. 


See Section 18.15, “Last Branch, Interrupt, and Exception Recording (Pentium M Processors),” and Section 18.16.2, “Last Branch and 


Last Exception MSRs.” 


that the processor executed prior to the last exception that was generated or the 


Register Address: 2FFH, 767 


IA32_MTRR_DEF_TYPE 


Default Memory Types (R/W) 


Sets the memory type for the regions of physical memory that are not mapped by the MTRRs. 


See Section 12.11.2.1, “IA32_MTRR_DEF_TYPE 


MSR.” 


Register Address: 400H, 1024 


IA32_MCO_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Register Address: 401H, 1025 


IA32_MCO_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Register Address: 402H, 1026 


IA32_MCO_ADDR 


See Section 14.3.2.3., “IA32_MCi_ADDR MSRs”. 


The IA32_MCO_ADDR register is either not implemented or contains no address if the ADDRV flag in the |A32_MCO_STATUS register 
is clear. When not implemented in the processor, 


all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 404H, 1028 


IA32_MC1_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 
Register Address: 405H, 1029 


IA32_MC1_STATUS 


See Section 16.3.2.2, "IA32_MCi_STATUS MSRS.” 


Register Address: 406H, 1030 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 


The IA32_MC1_ADDR register is either not implemented or contains no address if the ADDRV flag in the |A32_MC1_STATUS register 
is clear. When not implemented in the processor, 


IA32_MC1_ADDR 


all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 408H, 1032 


IA32_MC2_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 
Register Address: 409H, 1033 


IA32_MC2_STATUS 


See Chapter 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Register Address: 40AH, 1034 


IA32_MC2_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The IA32_MC2_ADDR register is either not implemented or contains no address if the ADDRV flag in the IA32_MC2_STATUS register 
, all reads and writes to this MSR will cause a general-protection exception. 


is clear. When not implemented in the processor, 
Register Address: 40CH, 1036 


MSR_MC4_CTL 


See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 


Register Address: 40DH, 1037 


MSR_MC4_STATUS 


See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 


Register Address: 40EH, 1038 


MSR_MC4_ADDR 
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Register Information / Bit Fields Bit Description 
See Section 16.3.2.3, “IA32_MCi_ADDR MSRs.” 


The MSR_MC4_ADDR register is either not implemented or contains no address if the ADDRV flag in the MSR_MC4_STATUS register 
is clear. When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 410H, 1040 MSR_MC3_CTL 

See Section 16.3.2.1, “IA32_MCi_CTL MSRs.” 

Register Address: 411H, 1041 MSR_MC3_STATUS 
See Section 16.3.2.2, “IA32_MCi_STATUS MSRS.” 

Register Address: 412H, 1042 MSR_MC3_ADDR 


See Section 16.3.2.3, “IA32_MCi_ADDR MSRs." 


The MSR_MC3_ADDR register is either not implemented or contains no address if the ADDRV flag in the MSR_MC3_STATUS register 
is clear. When not implemented in the processor, all reads and writes to this MSR will cause a general-protection exception. 


Register Address: 600H, 1536 IA32_DS_AREA 
DS Save Area (R/W) 
See Table 2-2. 


Points to the DS buffer management area, which is used to manage the BTS and PEBS buffers. See Section 20.6.3.4, “Debug Store 
(DS) Mechanism.” 


31:0 DS Buffer Management Area 
Linear address of the first byte of the DS buffer management area. 
63:32 Reserved. 


2.22 MSRSIN THE P6 FAMILY PROCESSORS 


The following MSRs are defined for the P6 family processors. The MSRs in this table that are shaded are available 

only in the Pentium II and Pentium III processors. Beginning with the Pentium 4 processor, some of the MSRs in this 
list have been designated as “architectural” and have had their names changed. See Table 2-2 for a list of the archi- 
tectural MSRs. 


Table 2-63. MSRs in the P6 Family Processors 


Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description 
Register Address: OH, O P5_MC_ADDR 
See Section 2.23, “MSRs in Pentium Processors.” 
Register Address: 1H, 1 P5_MC_TYPE 
See Section 2.23, “MSRs in Pentium Processors.” 
Register Address: 10H, 16 TSC 
See Section 18.17, “Time-Stamp Counter.” 
Register Address: 17H, 23 IA32_PLATFORM_ID 
Platform ID (R) 
The operating system can use this MSR to determine “slot” information for the processor and the proper microcode update to load. 
49:0 Reserved. 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


52:50 


Platform Id (R) 


Contains information concerning the intended platform for the processor. 


52 51 50 
0 O 0O- Processor Flag 0 
QO O 1. Processor Flag 1 
0 1  O- Processor Flag 2 
0 1. 1 Processor Flag 3 
1 0 0O- Processor Flag 4 
1 0 1 Processor Flag 5 
1 1  O- Processor Flag 6 
1 1 = 1 Processor Flag 7 

56:53 L2 Cache Latency Read. 

59:57 Reserved. 

60 Clock Frequency Ratio Read. 

63:61 Reserved. 

Register Address: 1BH, 27 APIC_BASE 


Section 11.4.4, “Local APIC Status and Location.” 


7:0 Reserved. 

8 Boot Strap Processor Indicator Bit 
1 = BSP 

10:9 Reserved. 

11 APIC Global Enable Bit - Permanent till reset 
1 = Enabled. 
0 = Disabled. 

31:12 APIC Base Address. 

63:32 Reserved. 


Register Address: 2AH, 42 


EBL_CR_POWERON 


Processor Hard Power-On Configuration 


(R/W) Enables and disables processor features, and (R) indicates current processor configuration. 


0 


Reserved! 


1 


Data Error Checking Enable (R/W) 
1 = Enabled. 
0 = Disabled. 


Response Error Checking Enable FRCERR Observation Enable (R/W) 
1 = Enabled. 

0 = Disabled. 

AERR# Drive Enable (R/W) 

1 = Enabled. 

0 = Disabled. 

BERR# Enable for Initiator Bus Requests (R/W) 

1 = Enabled. 

0 = Disabled. 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 


Reserved. 


BERR# Driver Enable for Initiator Internal Errors (R/W) 
1 = Enabled. 
0 = Disabled. 


BINIT# Driver Enable (R/W) 
1 = Enabled. 
0 = Disabled. 


Output Tri-state Enabled (R) 
1 = Enabled. 
0 = Disabled. 


Execute BIST (R) 
1 = Enabled. 
0 = Disabled. 


11 


AERR# Observation Enabled (R) 
1 = Enabled. 
0 = Disabled. 


Reserved. 


12 


BINIT# Observation Enabled (R) 
1 = Enabled. 
0 = Disabled. 


In Order Queue Depth (R) 

1=1. 

0=8. 

1-MByte Power on Reset Vector (R) 
1 = 1MByte. 

0 = 4GBytes. 


FRC Mode Enable (R) 
1 = Enabled. 
0 = Disabled. 


APIC Cluster ID (R) 


System Bus Frequency (R) 
00 = 66MHz. 

10 = 100Mhz. 

01 = 133MHz. 

11 = Reserved. 


21:20 


Symmetric Arbitration ID (R) 


25:22 


Clock Frequency Ratio (R) 


26 


Low Power Mode Enable (R/W) 


27 
63:28 


Clock Frequency Ratio 


Reserved. | 


Register Address: 33H, 51 


MSR_TEST_CTRL 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Test Control Register 


29:0 Reserved. 
30 Streaming Buffer Disable 
31 Disable LOCK# 


Assertion for split locked access. 


Register Address: 79H, 121 


BIOS_UPDT_TRIG 


BIOS Update Trigger Register. 


Register Address: 88H, 136 


BBL_CR_DO[63:0] 


Chunk 0 data register D[63:0]: used to write to and read from the L2. 


Register Address: 89H, 137 


BBL_CR_D1 


Chunk 1 data register D[63:0]: used to write to and read from the L2. 


Register Address: 8AH, 138 


BBL_CR_D2 


Chunk 2 data register D[63:0]: used to write to and read from the L2. 


Register Address: 8BH, 139 


BIOS_SIGN/BBL_CR_D3 


BIOS Update Signature Register or Chunk 3 data register D[63:0]. 
Used to write to and read from the L2 depending on the usage model. 


Register Address: C1H, 193 


PerfCtrO (PERFCTRO) 


Performance Counter Register 
See Table 2-2. 


Register Address: C2H, 194 


PerfCtr1 (PERFCTR1) 


Performance Counter Register 
See Table 2-2. 


Register Address: FEH, 254 MTRRcap 
Memory Type Range Registers 
Register Address: 116H, 278 BBL_CR_ADDR 


Address register: used to send specified address (A31-A3) to L2 during cache initialization accesses. 


2:0 Reserved; set to 0. 
31:3 Address bits [35:3]. 
63:32 Reserved. 

Register Address: 118H, 280 BBL_CR_DECC 


Data ECC register D[7:0]: used to write ECC and read ECC to/from L2. 


Register Address: 119H, 281 


BBL_CR_CTL 


Control register: used to program L2 commands to be issued via cache configuration accesses mechanism. Also receives L2 lookup 


response. 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description 
4:0 L2 Command: 
01100 = Data Read w/ LRU update (RLU). 
01110 = Tag Read w/ Data Read (TRR). 
01111 = Tag Inquire (Tl). 
00010 = L2 Control Register Read (CR). 
00011 =L2 Control Register Write (CW). 
010 + MESI encode = Tag Write w/ Data Read (TWR). 
111 + MESI encode = Tag Write w/ Data Write (TWw). 
100 + MESI encode = Tag Write (TW). 
6:5 
7 State to L2 
9:8 Reserved. 
11:10 Way 0 - 00, Way 1 - 01, Way 2 - 10, Way 3-11 
Way to L2 
13:12 Modified - 11,Exclusive - 10, Shared - 01, Invalid - 00 
Way from L2 
15:14 State from L2. 
16 Reserved. 
17 L2 Hit. 
18 Reserved. 
20:19 User supplied ECC. 
21 Processor number: ¢ 
Disable = 1. 
Enable = 0. 
Reserved. 
63:22 Reserved. 
Register Address: 11AH, 282 BBL_CR_TRIG 
Trigger register: used to initiate a cache configuration accesses access, Write only with Data = 0. 
Register Address: 11BH, 283 BBL_CR_BUSY 
Busy register: indicates when a cache configuration accesses L2 command is in progress. D[O] = 1 = BUSY. 
Register Address: 11€H, 286 BBL_CR_CTL3 
Control register 3: used to configure the L2 Cache. 
0 L2 Configured (read/write). 
4:1 L2 Cache Latency (read/write). 
5 ECC Check Enable (read/write). 
6 Address Parity Check Enable (read/write). 
7 CRTN Parity Check Enable (read/write). 
8 L2 Enabled (read/write). 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


10:9 


L2 Associativity (read only): 
00 = Direct Mapped. 
01 = 2 Way. 
10 = 4 Way. 
11 = Reserved. 


12:11 


Number of L2 banks (read only). 


17:13 


18 


Cache size per bank (read/write): 


00001 = 256 KBytes. 
00010 = 512 KBytes. 
00100 = 1 MByte. 
01000 = 2 MBytes. 
10000 = 4 MBytes. 


Cache State error checking enable (read/write). 


19 


Reserved. 


22:20 


L2 Physical Address Range support: 


111 = 64 GBytes. 
110 = 32 GBytes. 
101 = 16 GBytes. 
100 = 8 GBytes. 
011 = 4 GBytes. 
010 = 2 GBytes. 
001 = 1 GByte. 
000 = 512 MBytes. 


23 


L2 Hardware Disable (read only). 


24 


Reserved. 


25 


Cache bus fraction (read only). 


63:26 


Reserved. 


Register Address: 1 74H, 372 


SYSENTER_CS_MSR 


CS register target for CPL O code 
Register Address: 175H, 373 


SYSENTER_ESP_MSR 


Stack pointer for CPL O stack 


Register Address: 1 76H, 374 


SYSENTER_EIP_MSR 


CPL O code entry point 


Register Address: 1 79H, 377 MCG_CAP 
Machine Check Global Control Register 
Register Address: 17AH, 378 MCG_STATUS 


Machine Check Error Reporting Register - contains information related to a machine-check error if its VAL (valid) flag is set. Software 
is responsible for clearing |A32_MCi_STATUS MSRs by explicitly writing Os to them; writing 1s to them causes a general-protection 


exception. 


Register Address: 17BH, 379 


MCG_CTL 


Machine Check Error Reporting Register - controls signaling of #MC for errors produced by a particular hardware unit (or group of 


hardware units). 


Register Address: 186H, 390 


Perf€vtSelO (EVNTSELO) 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Performance Event Select Register O (R/W) 


7:0 


Event Select 
Refer to Performance Counter section for a list of event encodings. 


15:8 UMASK (Unit Mask) 
Unit mask register set to O to enable all count options. 
16 USER 
Controls the counting of events at Privilege levels of 1, 2, and 3. 
17 Os 
Controls the counting of events at Privilege level of 0. 
18 E 
Occurrence/Duration Mode Select: 
1 = Occurrence. 
0 = Duration. 
19 PC 
Enabled the signaling of performance counter overflow via BPO pin. 
20 INT 
Enables the signaling of counter overflow via input to APIC: 
1 = Enable. 
0 = Disable. 
22 ENABLE 
Enables the counting of performance events in both counters: 
1 = Enable. 
0 = Disable. 
23 INV 
Inverts the result of the CMASK condition: 
1 = Inverted. 
0 = Non-Inverted. 
31:24 CMASK (Counter Mask) 


Register Address: 187H, 391 


Perf€vtSell (EVNTSEL1) 


Performance Event Select for Counter 1 (R/W) 


7:0 Event Select 

Refer to Performance Counter section for a list of event encodings. 
15:8 UMASK (Unit Mask) 

Unit mask register set to O to enable all count options. 
16 USER 

Controls the counting of events at Privilege levels of 1, 2, and 3. 
17 OS 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


18 


E 

Occurrence/Duration Mode Select: 
1 = Occurrence. 

O = Duration. 


PC 
Enabled the signaling of performance counter overflow via BPO pin. 


20 


INT 

Enables the signaling of counter overflow via input to APIC. 
1 = Enable. 

0 = Disable. 


23 


31:24 


INV 

Inverts the result of the CMASK condition. 
1 = Inverted. 

O = Non-Inverted. 


CMASK (Counter Mask) 


Register Address: 1D9H, 473 


DEBUGCTLMSR 


Enables last branch, interrupt, and exception recording; taken branch breakpoints; the breakpoint reporting pins; and trace messages. 
This register can be written to using the WRMSR instruction, when operating at privilege level O or when in real-address mode. 


0 Enable/Disable Last Branch Records 

1 Branch Trap Flag 

2 Performance Monitoring/Break Point Pins 
3 Performance Monitoring/Break Point Pins 
4 Performance Monitoring/Break Point Pins 
5 Performance Monitoring/Break Point Pins 
6 Enable/Disable Execution Trace Messages 
31:7 Reserved. 

Register Address: 1DBH, 475 LASTBRANCHFROMIP 


32-bit register for recording the instructio 
debug exception being generated. 


n pointers for the last branch, interrupt, or exception that the processor took prior to a 


Register Address: 1DCH, 476 


32-bit register for recording the instructio 
debug exception being generated. 


LASTBRANCHTOIP 


n pointers for the last branch, interrupt, or exception that the processor took prior to a 


Register Address: 1DDH, 477 LASTINTFROMIP 
Last INT from IP 

Register Address: 1DEH, 478 LASTINTTOIP 
Last INT to IP 

Register Address: 200H, 512 MTRRphysBaseO 
Memory Type Range Registers 

Register Address: 201H, 513 MTRRphysMaskO 


Memory Type Range Registers 
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Register Address: Hex, Decimal Register Name 


Register Information / Bit Fields Bit Description 
Register Address: 202H, 514 MTRRphysBase1 
Memory Type Range Registers 
Register Address: 203H, 515 MTRRphysMask1 
Memory Type Range Registers 
Register Address: 204H, 516 MTRRphysBase2 
Memory Type Range Registers 
Register Address: 205H, 517 MTRRphysMask2 
Memory Type Range Registers 
Register Address: 206H, 518 MTRRphysBase3 
Memory Type Range Registers 
Register Address: 207H, 519 MTRRphysMask3 
Memory Type Range Registers 
Register Address: 208H, 520 MTRRphysBase4 
Memory Type Range Registers 
Register Address: 209H, 521 MTRRphysMask4 
Memory Type Range Registers 
Register Address: 20AH, 522 MTRRphysBase5 
Memory Type Range Registers 
Register Address: 20BH, 523 MTRRphysMask5 
Memory Type Range Registers 
Register Address: 20CH, 524 MTRRphysBase6 
Memory Type Range Registers 
Register Address: 20DH, 525 MTRRphysMask6 
Memory Type Range Registers 
Register Address: 20EH, 526 MTRRphysBase7 
Memory Type Range Registers 
Register Address: 20FH, 527 MTRRphysMask7 


Memory Type Range Registers 


Register Address: 250H, 592 


MTRRfix64K_O0000 


Memory Type Range Registers 


Register Address: 258H, 600 


MTRRfix16K_80000 


Memory Type Range Registers 


Register Address: 259H, 601 


MTRRfix16K_A0000 


Memory Type Range Registers 
Register Address: 268H, 616 


MTRRfix4K_COO00 


Memory Type Range Registers 


Register Address: 269H, 617 
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Register Address: Hex, Decimal 


Register Name 


Register Information / Bit Fields 


Bit Description 


Memory Type Range Registers 


Register Address: 26AH, 618 


MTRRfix4K_DOO0O 


Memory Type Range Registers 


Register Address: 26BH, 619 


MTRRfix4K_D8000 


Memory Type Range Registers 


Register Address: 26CH, 620 


MTRRfix4K_EOO00 


Memory Type Range Registers 


Register Address: 26DH, 621 


MTRRfix4K_E8000 


Memory Type Range Registers 


Register Address: 26EH, 622 


MTRRfix4K_FOO0O 


Memory Type Range Registers 


Register Address: 26FH, 623 


MTRRfix4K_F8000 


Memory Type Range Registers 


Register Address: 2FFH, 767 


MTRRdefType 


Memory Type Range Registers 


2:0 


Default memory type 


10 Fixed MTRR enable 
11 MTRR Enable 
Register Address: 400H, 1024 MCO_CTL 


Machine Check Error Reporting Register - controls signaling of #MC for errors produced by a particular hardware unit (or group of 


hardware units). 


Register Address: 401H, 1025 


MCO_STATUS 


Machine Check Error Reporting Register - contains information related to a machine-check error if its VAL (valid) flag is set. Software 
is responsible for clearing I[A32_MCi_STATUS MSRs by explicitly writing Os to them; writing 1s to them causes a general-protection 


exception. 

15:0 MC_STATUS_MCACOD 
31:16 MC_STATUS_MSCOD 
57 MC_STATUS_DAM 

58 MC_STATUS_ADDRV 
59 MC_STATUS_MISCV 
60 MC_STATUS_EN. (Note: For MCO_STATUS only, this bit is hardcoded to 1.) 
61 MC_STATUS_UC 

62 MC_STATUS_O 

63 MC_STATUS_V 
Register Address: 402H, 1026 MCO_ADDR 

Register Address: 403H, 1027 MCO_MISC 


Defined in MCA architecture but not implemented in the P6 family processors. 


Register Address: 404H, 1028 


MC1_CTL 
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Register Address: Hex, Decimal Register Name 
Register Information / Bit Fields Bit Description 
Register Address: 405H, 1029 MC1_STATUS 
Bit definitions same as MCO_STATUS. 
Register Address: 406H, 1030 MC1_ADDR 
Register Address: 407H, 1031 MC1_MISC 
Defined in MCA architecture but not implemented in the P6 family processors. 
Register Address: 408H, 1032 MC2_CTL 
Register Address: 409H, 1033 MC2_STATUS 
Bit definitions same as MCO_STATUS. 
Register Address: 40AH, 1034 MC2_ADDR 
Register Address: 40BH, 1035 MC2_MISC 
Defined in MCA architecture but not implemented in the P6 family processors. 
Register Address: 40CH, 1036 MC4_CTL 
Register Address: 40DH, 1037 MC4_STATUS 
Bit definitions same as MCO_STATUS, except bits 0, 4, 57, and 61 are hardcoded to 1. 
Register Address: 40€H, 1038 MC4_ADDR 
Defined in MCA architecture but not implemented in P6 Family processors. 
Register Address: 40FH, 1039 MC4_MISC 
Defined in MCA architecture but not implemented in the P6 family processors. 
Register Address: 410H, 1040 MC3_CTL 
Register Address: 411H, 1041 MC3_STATUS 
Bit definitions same as MCO_STATUS. 
Register Address: 412H, 1042 MC3_ADDR 
Register Address: 413H, 1043 MC3_MISC 
Defined in MCA architecture but not implemented in the P6 family processors. 
NOTES 


1. Bit O of this register has been redefined several times, and is no longer used in P6 family processors. 

2. The processor number feature may be disabled by setting bit 21 of the BBL_CR_CTL MSR (model-specific register address 119h) to 
“1", Once set, bit 21 of the BBL_CR_CTL may not be cleared. This bit is write-once. The processor number feature will be disabled 
until the processor is reset. 

3. The Pentium Ill processor will prevent FSB frequency overclocking with a new shutdown mechanism. If the FSB frequency selected 
is greater than the internal FSB frequency the processor will shutdown. If the FSB selected is less than the internal FSB frequency 
the BIOS may choose to use bit 11 to implement its own shutdown policy. 


2.23 MSRS IN PENTIUM PROCESSORS 


The following MSRs are defined for the Pentium processors. The PS_MC_ADDR, P5_MC_TYPE, and TSC MSRs 
(named IA32_P5_MC_ADDR, IA32_P5_MC_TYPE, and IA32_TIME_STAMP_COUNTER in the Pentium 4 processor) 
are architectural; that is, code that accesses these registers will run on Pentium 4 and P6 family processors without 
generating exceptions (see Section 2.1, “Architectural MSRs”). The CESR, CTRO, and CTR1 MSRs are unique to 
Pentium processors; code that accesses these registers will generate exceptions on Pentium 4 and P6 family 
processors. 
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Register Address: Hex, Decimal 


Register Information 


Register Name 


Register Address: OH, 0 


P5_MC_ADDR 


See Section 16.10.2, “Pentium Processor Machine-Check Exception Handling.” 


Register Address: 1H, 1 


P5_MC_TYPE 


See Section 16.10.2, “Pentium Processor Machine-Check Exception Handling.” 


Register Address: 10H, 16 TSC 

See Section 18.17, “Time-Stamp Counter.” 

Register Address: 11H, 17 CESR 

See Section 20.6.9.1, “Control and Event Select Register (CESR).” 
Register Address: 12H, 18 CTRO 

Section 20.6.9.3, “Events Counted.” 

Register Address: 13H, 19 CTR1 


Section 20.6.9.3, “Events Counted.” 
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